diff --git a/.github/workflows/ai-evals-scheduled.yml b/.github/workflows/ai-evals-scheduled.yml
index 4780eb02eb..580a757c21 100644
--- a/.github/workflows/ai-evals-scheduled.yml
+++ b/.github/workflows/ai-evals-scheduled.yml
@@ -16,7 +16,7 @@ on:
         default: "global cli"
       models:
         description: "Space-separated model aliases (bun run cli -- models); cli skips those it has no agent for"
-        default: "sonnet-5.5 opus-5.5 gpt-6-sol gpt-6-astra deepseek-v4-pro"
+        default: "sonnet-5.5 opus-5.5 gpt-6.1-sol gpt-6-astra deepseek-v4-pro"
       runs:
         description: "Runs per case"
         default: "3"
@@ -28,7 +28,7 @@ concurrency:
   group: ai-evals-scheduled-${{ github.ref }}
 
 env:
-  MODELS: ${{ inputs.models || 'sonnet-5.5 opus-5.5 gpt-6-sol gpt-6-astra deepseek-v4-pro' }}
+  MODELS: ${{ inputs.models || 'sonnet-5.5 opus-5.5 gpt-6.1-sol gpt-6-astra deepseek-v4-pro' }}
   RUNS: ${{ inputs.runs || '3' }}
   REASONING: ${{ inputs.reasoning }}
   # Routes on the cloud instance are prefixed with their workspace.
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 62ac9abafe..cc72934156 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.827.0"
+  ".": "1.828.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1b157fa61d..c958457c7a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,28 @@
 # Changelog
 
+## [1.828.0](https://github.com/windmill-labs/windmill/compare/v1.827.0...v1.828.0) (2026-10-08)
+
+
+### Features
+
+* add gpt-6.1-sol to the chat, agent steps and weekly ai evals ([#11584](https://github.com/windmill-labs/windmill/issues/11584)) ([8f7e0c7](https://github.com/windmill-labs/windmill/commit/8f7e0c72848b56fa97f6f0141d930c7d15044864))
+* add wmill user list and document post-suspend approvers context ([#11600](https://github.com/windmill-labs/windmill/issues/11600)) ([1c2667c](https://github.com/windmill-labs/windmill/commit/1c2667cd5530925893cf69fd622938b6ffa55d1d))
+* ask before minting the frontend sdk token in the raw app editor ([#11604](https://github.com/windmill-labs/windmill/issues/11604)) ([6e948b0](https://github.com/windmill-labs/windmill/commit/6e948b07d13b85e9251c3a200bf149f167649bc4))
+* improve data table roles and grants UX ([#11562](https://github.com/windmill-labs/windmill/issues/11562)) ([d7d18f0](https://github.com/windmill-labs/windmill/commit/d7d18f00af4e2df8fcb1362c9439d2250d0ce4b6))
+* one page header across routes, and one sidebar for operators and developers ([#11310](https://github.com/windmill-labs/windmill/issues/11310)) ([41162b2](https://github.com/windmill-labs/windmill/commit/41162b270c70ddac6a256bde9acf31a629990e24))
+
+
+### Bug Fixes
+
+* add retry to runScriptByPathAsync and runScriptByHashAsync ([#11485](https://github.com/windmill-labs/windmill/issues/11485)) ([3f3b1c2](https://github.com/windmill-labs/windmill/commit/3f3b1c2c308ddaba377db45308711e7c660d8775))
+* describe exponential retry as multiplier × seconds^attempt ([#11546](https://github.com/windmill-labs/windmill/issues/11546)) ([a2e51cd](https://github.com/windmill-labs/windmill/commit/a2e51cdbaafb7d71b8e8bbd818e40c472098f9ba))
+* keep capturing job logs after a non-UTF-8 output line ([#11595](https://github.com/windmill-labs/windmill/issues/11595)) ([0e7d974](https://github.com/windmill-labs/windmill/commit/0e7d974ce9b468353ecb6618dace710704690687))
+
+
+### Performance Improvements
+
+* load public raw apps without the loading screen ([#11608](https://github.com/windmill-labs/windmill/issues/11608)) ([c09764f](https://github.com/windmill-labs/windmill/commit/c09764fa6516badddbdbb520af32e5d1541cf996))
+
 ## [1.827.0](https://github.com/windmill-labs/windmill/compare/v1.826.0...v1.827.0) (2026-10-07)
 
 
diff --git a/ai_evals/core/models.ts b/ai_evals/core/models.ts
index 22af20d5c3..cf131337fd 100644
--- a/ai_evals/core/models.ts
+++ b/ai_evals/core/models.ts
@@ -148,6 +148,15 @@ export const EVAL_MODELS: EvalModelSpec[] = [
       model: "gpt-6-astra",
     },
   },
+  {
+    id: "gpt-6.1-sol",
+    label: "GPT-6.1 Sol",
+    aliases: ["gpt-6.1-sol"],
+    frontend: {
+      provider: "openai",
+      model: "gpt-6.1-sol",
+    },
+  },
   {
     id: "gpt-6-sol",
     label: "GPT-6 Sol",
diff --git a/backend/.sqlx/query-1333436e3d0466eccdaf99fb70aadad56b50619036fab3f2c1bdbbf280a80217.json b/backend/.sqlx/query-1333436e3d0466eccdaf99fb70aadad56b50619036fab3f2c1bdbbf280a80217.json
new file mode 100644
index 0000000000..1946f55366
--- /dev/null
+++ b/backend/.sqlx/query-1333436e3d0466eccdaf99fb70aadad56b50619036fab3f2c1bdbbf280a80217.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH prev AS (SELECT started_at FROM v2_job_queue WHERE id = $1)\n                 UPDATE v2_job_queue q SET running = false, started_at = null,\n                     extras = CASE WHEN q.started_at IS NULL OR q.extras ? 'wac_first_started_at' THEN q.extras\n                         ELSE jsonb_set(COALESCE(q.extras, '{}'::jsonb), '{wac_first_started_at}', to_jsonb(q.started_at))\n                     END\n                 FROM prev WHERE q.id = $1\n                 RETURNING (extract(epoch FROM now() - prev.started_at) * 1000)::bigint",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "int8",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "1333436e3d0466eccdaf99fb70aadad56b50619036fab3f2c1bdbbf280a80217"
+}
diff --git a/backend/.sqlx/query-1e3407ad2ec46bd965f2aeede0d3cd4a3f9226a5e0c6b15c2580ddd1dba6199b.json b/backend/.sqlx/query-1e3407ad2ec46bd965f2aeede0d3cd4a3f9226a5e0c6b15c2580ddd1dba6199b.json
new file mode 100644
index 0000000000..036610e08c
--- /dev/null
+++ b/backend/.sqlx/query-1e3407ad2ec46bd965f2aeede0d3cd4a3f9226a5e0c6b15c2580ddd1dba6199b.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT wp.draining FROM v2_job_queue q JOIN worker_ping wp ON wp.worker = q.worker\n            WHERE q.id = $1 AND q.workspace_id = $2 AND q.running AND q.started_at IS NOT NULL",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "draining",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1e3407ad2ec46bd965f2aeede0d3cd4a3f9226a5e0c6b15c2580ddd1dba6199b"
+}
diff --git a/backend/.sqlx/query-71c9e0c0f1d9eba0f24c8e410ca2f2a64dc559e3228d3b763f68b1ad3491ae6e.json b/backend/.sqlx/query-71c9e0c0f1d9eba0f24c8e410ca2f2a64dc559e3228d3b763f68b1ad3491ae6e.json
new file mode 100644
index 0000000000..ba1cc13fac
--- /dev/null
+++ b/backend/.sqlx/query-71c9e0c0f1d9eba0f24c8e410ca2f2a64dc559e3228d3b763f68b1ad3491ae6e.json
@@ -0,0 +1,45 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH deleted AS (\n            DELETE FROM v2_job_queue WHERE id = $1\n            RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason,\n                (extras->>'wac_first_started_at')::timestamptz AS first_started_at,\n                COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000)::bigint AS run_ms\n        ), completed AS (\n            INSERT INTO v2_job_completed AS cj\n                ( workspace_id\n                , id\n                , started_at\n                , duration_ms\n                , extras\n                , result\n                , result_columns\n                , canceled_by\n                , canceled_reason\n                , flow_status\n                , workflow_as_code_status\n                , memory_peak\n                , status\n                , worker\n                )\n            SELECT d.workspace_id, d.id, COALESCE(d.first_started_at, d.started_at),\n                CASE WHEN d.first_started_at IS NULL THEN d.run_ms\n                    ELSE EXTRACT('epoch' FROM (now() - d.first_started_at))*1000 END,\n                CASE WHEN d.first_started_at IS NOT NULL\n                    THEN jsonb_build_object('wac_last_segment_ms', d.run_ms) END,\n                $3::text::jsonb, $10,\n                CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,\n                CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,\n                s.flow_status, s.workflow_as_code_status, $8,\n                CASE WHEN $4::BOOL OR d.canceled_by IS NOT NULL THEN 'canceled'::job_status\n                    WHEN $7::BOOL THEN 'skipped'::job_status\n                    WHEN $2::BOOL THEN 'success'::job_status\n                    ELSE 'failure'::job_status END,\n                d.worker\n            FROM deleted d LEFT JOIN v2_job_status s ON s.id = d.id\n            ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3::text::jsonb,\n                canceled_by = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                    THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,\n                canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                    THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END\n            RETURNING cj.started_at, cj.duration_ms,\n                COALESCE((cj.extras->>'wac_last_segment_ms')::bigint, cj.duration_ms) AS last_run_ms\n        ), parent_ping AS (\n            UPDATE v2_job_runtime r SET ping = now()\n            FROM v2_job_queue q\n            WHERE r.id = $11 AND q.id = r.id AND q.workspace_id = $12\n                AND EXISTS (SELECT 1 FROM completed)\n        )\n        SELECT started_at AS \"started_at?\", duration_ms AS \"duration_ms!\",\n            last_run_ms AS \"last_run_ms!\" FROM completed",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "started_at?",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "duration_ms!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "last_run_ms!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Bool",
+        "Text",
+        "Bool",
+        "Varchar",
+        "Text",
+        "Bool",
+        "Int4",
+        "Int8",
+        "TextArray",
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      false,
+      null
+    ]
+  },
+  "hash": "71c9e0c0f1d9eba0f24c8e410ca2f2a64dc559e3228d3b763f68b1ad3491ae6e"
+}
diff --git a/backend/.sqlx/query-7963eff5f7109874b94c0940eaef7d4b418a9e82be56dfe7dd65d160e0dcfd13.json b/backend/.sqlx/query-7963eff5f7109874b94c0940eaef7d4b418a9e82be56dfe7dd65d160e0dcfd13.json
new file mode 100644
index 0000000000..1c8dfcfa57
--- /dev/null
+++ b/backend/.sqlx/query-7963eff5f7109874b94c0940eaef7d4b418a9e82be56dfe7dd65d160e0dcfd13.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT wp.draining FROM v2_job j\n            JOIN v2_job_queue q ON q.id = j.id\n            JOIN worker_ping wp ON wp.worker = q.worker\n            WHERE j.id = $1 AND j.workspace_id = $2 AND q.running AND q.started_at IS NOT NULL\n            AND ($3::text[] IS NULL OR j.tag = ANY($3))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "draining",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "7963eff5f7109874b94c0940eaef7d4b418a9e82be56dfe7dd65d160e0dcfd13"
+}
diff --git a/backend/.sqlx/query-9212902d4eb2834ab3b429968a7a85c53c49e4ef0f42c146324d5c71fbd1e21d.json b/backend/.sqlx/query-9212902d4eb2834ab3b429968a7a85c53c49e4ef0f42c146324d5c71fbd1e21d.json
deleted file mode 100644
index f105dd7825..0000000000
--- a/backend/.sqlx/query-9212902d4eb2834ab3b429968a7a85c53c49e4ef0f42c146324d5c71fbd1e21d.json
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH deleted AS (\n                    DELETE FROM v2_job_queue WHERE id = $1\n                    RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason\n                ), completed AS (\n                    INSERT INTO v2_job_completed AS cj\n                        ( workspace_id\n                        , id\n                        , started_at\n                        , duration_ms\n                        , result\n                        , result_columns\n                        , canceled_by\n                        , canceled_reason\n                        , flow_status\n                        , workflow_as_code_status\n                        , memory_peak\n                        , status\n                        , worker\n                        )\n                    SELECT d.workspace_id, d.id, d.started_at,\n                        COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(d.started_at, now()))))*1000),\n                        $3::text::jsonb, $10,\n                        CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,\n                        CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,\n                        s.flow_status, s.workflow_as_code_status, $8,\n                        CASE WHEN $4::BOOL OR d.canceled_by IS NOT NULL THEN 'canceled'::job_status\n                            WHEN $7::BOOL THEN 'skipped'::job_status\n                            WHEN $2::BOOL THEN 'success'::job_status\n                            ELSE 'failure'::job_status END,\n                        d.worker\n                    FROM deleted d LEFT JOIN v2_job_status s ON s.id = d.id\n                    ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3::text::jsonb,\n                        canceled_by = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                            THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,\n                        canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                            THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END\n                    RETURNING duration_ms\n                )\n                SELECT duration_ms AS \"duration_ms!\" FROM completed",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "duration_ms!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Bool",
-        "Text",
-        "Bool",
-        "Varchar",
-        "Text",
-        "Bool",
-        "Int4",
-        "Int8",
-        "TextArray"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "9212902d4eb2834ab3b429968a7a85c53c49e4ef0f42c146324d5c71fbd1e21d"
-}
diff --git a/backend/.sqlx/query-975158ae72ec12f3f933fba1d9623bf1c925feebe746299cd1f0eda3f8b949d5.json b/backend/.sqlx/query-975158ae72ec12f3f933fba1d9623bf1c925feebe746299cd1f0eda3f8b949d5.json
deleted file mode 100644
index 0b166b32a4..0000000000
--- a/backend/.sqlx/query-975158ae72ec12f3f933fba1d9623bf1c925feebe746299cd1f0eda3f8b949d5.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH deleted AS (\n            DELETE FROM v2_job_queue WHERE id = $1\n            RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason\n        ), completed AS (\n            INSERT INTO v2_job_completed AS cj\n                ( workspace_id\n                , id\n                , started_at\n                , duration_ms\n                , result\n                , result_columns\n                , canceled_by\n                , canceled_reason\n                , flow_status\n                , workflow_as_code_status\n                , memory_peak\n                , status\n                , worker\n                )\n            SELECT d.workspace_id, d.id, d.started_at,\n                COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(d.started_at, now()))))*1000),\n                $3::text::jsonb, $10,\n                CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,\n                CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,\n                s.flow_status, s.workflow_as_code_status, $8,\n                CASE WHEN $4::BOOL OR d.canceled_by IS NOT NULL THEN 'canceled'::job_status\n                    WHEN $7::BOOL THEN 'skipped'::job_status\n                    WHEN $2::BOOL THEN 'success'::job_status\n                    ELSE 'failure'::job_status END,\n                d.worker\n            FROM deleted d LEFT JOIN v2_job_status s ON s.id = d.id\n            ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3::text::jsonb,\n                canceled_by = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                    THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,\n                canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                    THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END\n            RETURNING duration_ms\n        ), parent_ping AS (\n            UPDATE v2_job_runtime r SET ping = now()\n            FROM v2_job_queue q\n            WHERE r.id = $11 AND q.id = r.id AND q.workspace_id = $12\n                AND EXISTS (SELECT 1 FROM completed)\n        )\n        SELECT duration_ms AS \"duration_ms!\" FROM completed",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "duration_ms!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Bool",
-        "Text",
-        "Bool",
-        "Varchar",
-        "Text",
-        "Bool",
-        "Int4",
-        "Int8",
-        "TextArray",
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "975158ae72ec12f3f933fba1d9623bf1c925feebe746299cd1f0eda3f8b949d5"
-}
diff --git a/backend/.sqlx/query-9e7a5e1ebba42217092971dd340cd9182a4812b14735e502958eaafeb4c6b33d.json b/backend/.sqlx/query-9e7a5e1ebba42217092971dd340cd9182a4812b14735e502958eaafeb4c6b33d.json
new file mode 100644
index 0000000000..59ed0e1767
--- /dev/null
+++ b/backend/.sqlx/query-9e7a5e1ebba42217092971dd340cd9182a4812b14735e502958eaafeb4c6b33d.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_queue\n         SET suspend = $3, suspend_until = now() + make_interval(secs => $4), started_at = null,\n             extras = CASE WHEN started_at IS NULL OR extras ? 'wac_first_started_at' THEN extras\n                 ELSE jsonb_set(COALESCE(extras, '{}'::jsonb), '{wac_first_started_at}', to_jsonb(started_at))\n             END\n         WHERE id = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "Int4",
+        "Float8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9e7a5e1ebba42217092971dd340cd9182a4812b14735e502958eaafeb4c6b33d"
+}
diff --git a/backend/.sqlx/query-a2f6ca89faaa8d8739f67cd1aae571de793b377dd6058065f51b12c974e5b665.json b/backend/.sqlx/query-a2f6ca89faaa8d8739f67cd1aae571de793b377dd6058065f51b12c974e5b665.json
deleted file mode 100644
index 2358af807f..0000000000
--- a/backend/.sqlx/query-a2f6ca89faaa8d8739f67cd1aae571de793b377dd6058065f51b12c974e5b665.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n    SELECT usr.email, usage.executions\n        FROM usr, LATERAL (\n            SELECT COALESCE(SUM(c.duration_ms + 1000)/1000 , 0)::BIGINT executions\n                FROM v2_job_completed c JOIN v2_job j USING (id)\n                WHERE j.workspace_id = $1\n                AND j.kind NOT IN ('flow', 'flowpreview', 'flownode', 'singlestepflow')\n                AND j.permissioned_as_email = usr.email\n                AND now() - '1 week'::interval < j.created_at\n            ) usage\n        WHERE workspace_id = $1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "email",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "executions",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      null
-    ]
-  },
-  "hash": "a2f6ca89faaa8d8739f67cd1aae571de793b377dd6058065f51b12c974e5b665"
-}
diff --git a/backend/.sqlx/query-c748617e060bc41b5922df4b433f20b6971b993e0671b6ccb45db5ef028550bc.json b/backend/.sqlx/query-c748617e060bc41b5922df4b433f20b6971b993e0671b6ccb45db5ef028550bc.json
deleted file mode 100644
index 7f6fe7a81c..0000000000
--- a/backend/.sqlx/query-c748617e060bc41b5922df4b433f20b6971b993e0671b6ccb45db5ef028550bc.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, dedicated_workers, wm_version, vcpus, memory, job_isolation, native_mode) VALUES ($1, $2, COALESCE($3, 'NO IP'), $4, $5, $6, $7, $8, $9, $10, $11, $12) ON CONFLICT (worker)\n        DO UPDATE set ping_at = now(), worker_instance = EXCLUDED.worker_instance, ip = COALESCE($3, worker_ping.ip), custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group, dedicated_worker = EXCLUDED.dedicated_worker, dedicated_workers = EXCLUDED.dedicated_workers, wm_version = EXCLUDED.wm_version, vcpus = COALESCE(EXCLUDED.vcpus, worker_ping.vcpus), memory = COALESCE(EXCLUDED.memory, worker_ping.memory), job_isolation = EXCLUDED.job_isolation, native_mode = EXCLUDED.native_mode, current_job_id = NULL, current_job_workspace_id = NULL\n        RETURNING jobs_executed",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "jobs_executed",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Text",
-        "TextArray",
-        "Varchar",
-        "Varchar",
-        "TextArray",
-        "Varchar",
-        "Int8",
-        "Int8",
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "c748617e060bc41b5922df4b433f20b6971b993e0671b6ccb45db5ef028550bc"
-}
diff --git a/backend/.sqlx/query-ce39fd9650500b16f7247c8173a40c7e5d2d8a51aea2d36f2bc8c6f86d53a9b8.json b/backend/.sqlx/query-ce39fd9650500b16f7247c8173a40c7e5d2d8a51aea2d36f2bc8c6f86d53a9b8.json
new file mode 100644
index 0000000000..ba7a89ef73
--- /dev/null
+++ b/backend/.sqlx/query-ce39fd9650500b16f7247c8173a40c7e5d2d8a51aea2d36f2bc8c6f86d53a9b8.json
@@ -0,0 +1,43 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH deleted AS (\n                    DELETE FROM v2_job_queue WHERE id = $1\n                    RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason,\n                        (extras->>'wac_first_started_at')::timestamptz AS first_started_at,\n                        COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000)::bigint AS run_ms\n                ), completed AS (\n                    INSERT INTO v2_job_completed AS cj\n                        ( workspace_id\n                        , id\n                        , started_at\n                        , duration_ms\n                        , extras\n                        , result\n                        , result_columns\n                        , canceled_by\n                        , canceled_reason\n                        , flow_status\n                        , workflow_as_code_status\n                        , memory_peak\n                        , status\n                        , worker\n                        )\n                    SELECT d.workspace_id, d.id, COALESCE(d.first_started_at, d.started_at),\n                        CASE WHEN d.first_started_at IS NULL THEN d.run_ms\n                            ELSE EXTRACT('epoch' FROM (now() - d.first_started_at))*1000 END,\n                        CASE WHEN d.first_started_at IS NOT NULL\n                            THEN jsonb_build_object('wac_last_segment_ms', d.run_ms) END,\n                        $3::text::jsonb, $10,\n                        CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,\n                        CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,\n                        s.flow_status, s.workflow_as_code_status, $8,\n                        CASE WHEN $4::BOOL OR d.canceled_by IS NOT NULL THEN 'canceled'::job_status\n                            WHEN $7::BOOL THEN 'skipped'::job_status\n                            WHEN $2::BOOL THEN 'success'::job_status\n                            ELSE 'failure'::job_status END,\n                        d.worker\n                    FROM deleted d LEFT JOIN v2_job_status s ON s.id = d.id\n                    ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3::text::jsonb,\n                        canceled_by = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                            THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,\n                        canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                            THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END\n                    RETURNING cj.started_at, cj.duration_ms,\n                        COALESCE((cj.extras->>'wac_last_segment_ms')::bigint, cj.duration_ms) AS last_run_ms\n                )\n                SELECT started_at AS \"started_at?\", duration_ms AS \"duration_ms!\",\n                    last_run_ms AS \"last_run_ms!\" FROM completed",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "started_at?",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "duration_ms!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "last_run_ms!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Bool",
+        "Text",
+        "Bool",
+        "Varchar",
+        "Text",
+        "Bool",
+        "Int4",
+        "Int8",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      true,
+      false,
+      null
+    ]
+  },
+  "hash": "ce39fd9650500b16f7247c8173a40c7e5d2d8a51aea2d36f2bc8c6f86d53a9b8"
+}
diff --git a/backend/.sqlx/query-de1adae1306fb9d877ec6f2d52235b3f57d4fa4c27861b51da6bfe8c74abd429.json b/backend/.sqlx/query-de1adae1306fb9d877ec6f2d52235b3f57d4fa4c27861b51da6bfe8c74abd429.json
new file mode 100644
index 0000000000..48963d9ef7
--- /dev/null
+++ b/backend/.sqlx/query-de1adae1306fb9d877ec6f2d52235b3f57d4fa4c27861b51da6bfe8c74abd429.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT q.id FROM v2_job_queue q\n            JOIN native_retry_attempt n ON n.job_id = q.id\n            JOIN v2_job r ON r.id = q.id\n            JOIN v2_job a ON a.id = r.parent_job\n            WHERE q.workspace_id = $2 AND a.parent_job = ANY($1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "UuidArray",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "de1adae1306fb9d877ec6f2d52235b3f57d4fa4c27861b51da6bfe8c74abd429"
+}
diff --git a/backend/.sqlx/query-e12f852fa196d16862151ab490b05e6f5c25e23b7c41ce1c0e5a83bf7b118bfd.json b/backend/.sqlx/query-e12f852fa196d16862151ab490b05e6f5c25e23b7c41ce1c0e5a83bf7b118bfd.json
deleted file mode 100644
index ae893b6791..0000000000
--- a/backend/.sqlx/query-e12f852fa196d16862151ab490b05e6f5c25e23b7c41ce1c0e5a83bf7b118bfd.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH prev AS (SELECT started_at FROM v2_job_queue WHERE id = $1)\n                 UPDATE v2_job_queue q SET running = false, started_at = null\n                 FROM prev WHERE q.id = $1\n                 RETURNING (extract(epoch FROM now() - prev.started_at) * 1000)::bigint",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "int8",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "e12f852fa196d16862151ab490b05e6f5c25e23b7c41ce1c0e5a83bf7b118bfd"
-}
diff --git a/backend/.sqlx/query-e4b9c0e8a46dbfe29bace8d8b12123a98ec175f9d3dc72e40a1cb40e14dec919.json b/backend/.sqlx/query-e4b9c0e8a46dbfe29bace8d8b12123a98ec175f9d3dc72e40a1cb40e14dec919.json
new file mode 100644
index 0000000000..9ebf9289c2
--- /dev/null
+++ b/backend/.sqlx/query-e4b9c0e8a46dbfe29bace8d8b12123a98ec175f9d3dc72e40a1cb40e14dec919.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE worker_ping SET draining = true WHERE worker = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e4b9c0e8a46dbfe29bace8d8b12123a98ec175f9d3dc72e40a1cb40e14dec919"
+}
diff --git a/backend/.sqlx/query-e7a8c0ee68b8626eb45a7eacdd364360a5d5c783d6ca0a3c4123ea126ed0e60b.json b/backend/.sqlx/query-e7a8c0ee68b8626eb45a7eacdd364360a5d5c783d6ca0a3c4123ea126ed0e60b.json
new file mode 100644
index 0000000000..9f51c69616
--- /dev/null
+++ b/backend/.sqlx/query-e7a8c0ee68b8626eb45a7eacdd364360a5d5c783d6ca0a3c4123ea126ed0e60b.json
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, dedicated_workers, wm_version, vcpus, memory, job_isolation, native_mode, draining) VALUES ($1, $2, COALESCE($3, 'NO IP'), $4, $5, $6, $7, $8, $9, $10, $11, $12, COALESCE($13, false)) ON CONFLICT (worker)\n        DO UPDATE set ping_at = now(), worker_instance = EXCLUDED.worker_instance, ip = COALESCE($3, worker_ping.ip), custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group, dedicated_worker = EXCLUDED.dedicated_worker, dedicated_workers = EXCLUDED.dedicated_workers, wm_version = EXCLUDED.wm_version, vcpus = COALESCE(EXCLUDED.vcpus, worker_ping.vcpus), memory = COALESCE(EXCLUDED.memory, worker_ping.memory), job_isolation = EXCLUDED.job_isolation, native_mode = EXCLUDED.native_mode, current_job_id = NULL, current_job_workspace_id = NULL, draining = COALESCE($13, worker_ping.draining)\n        RETURNING jobs_executed",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "jobs_executed",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Text",
+        "TextArray",
+        "Varchar",
+        "Varchar",
+        "TextArray",
+        "Varchar",
+        "Int8",
+        "Int8",
+        "Text",
+        "Bool",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "e7a8c0ee68b8626eb45a7eacdd364360a5d5c783d6ca0a3c4123ea126ed0e60b"
+}
diff --git a/backend/.sqlx/query-e8779f1cddc475554dbbd2e3122db8a21a2eaacf971bf046cef1ee14cf04e323.json b/backend/.sqlx/query-e8779f1cddc475554dbbd2e3122db8a21a2eaacf971bf046cef1ee14cf04e323.json
new file mode 100644
index 0000000000..e22953610d
--- /dev/null
+++ b/backend/.sqlx/query-e8779f1cddc475554dbbd2e3122db8a21a2eaacf971bf046cef1ee14cf04e323.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n    SELECT usr.email, usage.executions\n        FROM usr, LATERAL (\n            SELECT COALESCE(SUM(COALESCE((c.extras->>'wac_last_segment_ms')::bigint, c.duration_ms) + 1000)/1000 , 0)::BIGINT executions\n                FROM v2_job_completed c JOIN v2_job j USING (id)\n                WHERE j.workspace_id = $1\n                AND j.kind NOT IN ('flow', 'flowpreview', 'flownode', 'singlestepflow')\n                AND j.permissioned_as_email = usr.email\n                AND now() - '1 week'::interval < j.created_at\n            ) usage\n        WHERE workspace_id = $1\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "executions",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      null
+    ]
+  },
+  "hash": "e8779f1cddc475554dbbd2e3122db8a21a2eaacf971bf046cef1ee14cf04e323"
+}
diff --git a/backend/.sqlx/query-e34cb7cd6ff9d80e77a51ae47c3cfb9b0772d5d3d239273fc5cea322cae4e258.json b/backend/.sqlx/query-eecea4a5ba0de73129bde6ed0c229690c322bc376b1bfc13ed719126f72cabb9.json
similarity index 80%
rename from backend/.sqlx/query-e34cb7cd6ff9d80e77a51ae47c3cfb9b0772d5d3d239273fc5cea322cae4e258.json
rename to backend/.sqlx/query-eecea4a5ba0de73129bde6ed0c229690c322bc376b1bfc13ed719126f72cabb9.json
index 4ebad828df..1670a5009e 100644
--- a/backend/.sqlx/query-e34cb7cd6ff9d80e77a51ae47c3cfb9b0772d5d3d239273fc5cea322cae4e258.json
+++ b/backend/.sqlx/query-eecea4a5ba0de73129bde6ed0c229690c322bc376b1bfc13ed719126f72cabb9.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO job_resolution (job_id, workspace_id, resolved_by, note, automatic)\n            SELECT c.id, c.workspace_id, NULL, NULL, true\n                FROM v2_job_completed c\n                JOIN v2_job j ON j.id = c.id\n                WHERE c.status = 'failure'\n                    AND c.workspace_id = $2\n                    AND j.flow_step_id IS NULL\n                    AND j.runnable_id IS NOT DISTINCT FROM $3\n                    AND EXISTS (\n                        SELECT 1 FROM v2_job_completed sc\n                        JOIN v2_job sj ON sj.id = sc.id\n                        JOIN native_retry_attempt nra ON nra.job_id = sc.id\n                        WHERE sc.status = 'success'\n                            AND sc.workspace_id = $2\n                            AND sj.parent_job = $1\n                            AND sj.runnable_id IS NOT DISTINCT FROM $3\n                    )\n                    AND (\n                        (j.parent_job = $1\n                            AND EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))\n                        OR (c.id = $1 AND j.parent_job IS NULL\n                            AND NOT EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))\n                    )\n            ON CONFLICT (job_id) DO NOTHING",
+  "query": "INSERT INTO job_resolution (job_id, workspace_id, resolved_by, note, automatic)\n            SELECT c.id, c.workspace_id, NULL, NULL, true\n                FROM v2_job_completed c\n                JOIN v2_job j ON j.id = c.id\n                WHERE c.status = 'failure'\n                    AND c.workspace_id = $2\n                    AND j.flow_step_id IS NULL\n                    AND j.runnable_id IS NOT DISTINCT FROM $3\n                    AND EXISTS (\n                        SELECT 1 FROM v2_job_completed sc\n                        JOIN v2_job sj ON sj.id = sc.id\n                        JOIN native_retry_attempt nra ON nra.job_id = sc.id\n                        WHERE sc.status = 'success'\n                            AND sc.workspace_id = $2\n                            AND sj.parent_job = $1\n                            AND sj.runnable_id IS NOT DISTINCT FROM $3\n                    )\n                    AND (\n                        (j.parent_job = $1\n                            AND EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))\n                        OR (c.id = $1\n                            AND NOT EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))\n                    )\n            ON CONFLICT (job_id) DO NOTHING",
   "describe": {
     "columns": [],
     "parameters": {
@@ -12,5 +12,5 @@
     },
     "nullable": []
   },
-  "hash": "e34cb7cd6ff9d80e77a51ae47c3cfb9b0772d5d3d239273fc5cea322cae4e258"
+  "hash": "eecea4a5ba0de73129bde6ed0c229690c322bc376b1bfc13ed719126f72cabb9"
 }
diff --git a/backend/.sqlx/query-f0498c9bddc0d4d8948167f3ed849bf8b3523d8dde1ef6b8f1950423830cc6ed.json b/backend/.sqlx/query-f0498c9bddc0d4d8948167f3ed849bf8b3523d8dde1ef6b8f1950423830cc6ed.json
deleted file mode 100644
index 5f86fb97d8..0000000000
--- a/backend/.sqlx/query-f0498c9bddc0d4d8948167f3ed849bf8b3523d8dde1ef6b8f1950423830cc6ed.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE v2_job_queue\n         SET suspend = $3, suspend_until = now() + make_interval(secs => $4), started_at = null\n         WHERE id = $1 AND workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text",
-        "Int4",
-        "Float8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "f0498c9bddc0d4d8948167f3ed849bf8b3523d8dde1ef6b8f1950423830cc6ed"
-}
diff --git a/backend/.sqlx/query-68bca8f839e47705b11d312ee874eceaa3d1d24d9053ad4aea94b9f8465585ca.json b/backend/.sqlx/query-fe22c4609d8b2472c0f83fedb92eceec2b6f1ae1a32fcf375161d04419404d9c.json
similarity index 86%
rename from backend/.sqlx/query-68bca8f839e47705b11d312ee874eceaa3d1d24d9053ad4aea94b9f8465585ca.json
rename to backend/.sqlx/query-fe22c4609d8b2472c0f83fedb92eceec2b6f1ae1a32fcf375161d04419404d9c.json
index 583d2bcc6b..5ee5c7571d 100644
--- a/backend/.sqlx/query-68bca8f839e47705b11d312ee874eceaa3d1d24d9053ad4aea94b9f8465585ca.json
+++ b/backend/.sqlx/query-fe22c4609d8b2472c0f83fedb92eceec2b6f1ae1a32fcf375161d04419404d9c.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT worker, worker_instance,  EXTRACT(EPOCH FROM (now() - ping_at))::integer as last_ping, started_at, ip, jobs_executed,\n        CASE WHEN $4 IS TRUE THEN current_job_id ELSE NULL END as last_job_id, CASE WHEN $4 IS TRUE THEN current_job_workspace_id ELSE NULL END as last_job_workspace_id,\n        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage, job_isolation, native_mode\n        FROM worker_ping\n        WHERE ($1::integer IS NULL AND ping_at > now() - interval '5 minute') OR (ping_at > now() - ($1 || ' seconds')::interval)\n        ORDER BY ping_at desc LIMIT $2 OFFSET $3",
+  "query": "SELECT worker, worker_instance,  EXTRACT(EPOCH FROM (now() - ping_at))::integer as last_ping, started_at, ip, jobs_executed,\n        CASE WHEN $4 IS TRUE THEN current_job_id ELSE NULL END as last_job_id, CASE WHEN $4 IS TRUE THEN current_job_workspace_id ELSE NULL END as last_job_workspace_id,\n        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage, job_isolation, native_mode, draining\n        FROM worker_ping\n        WHERE ($1::integer IS NULL AND ping_at > now() - interval '5 minute') OR (ping_at > now() - ($1 || ' seconds')::interval)\n        ORDER BY ping_at desc LIMIT $2 OFFSET $3",
   "describe": {
     "columns": [
       {
@@ -107,6 +107,11 @@
         "ordinal": 20,
         "name": "native_mode",
         "type_info": "Bool"
+      },
+      {
+        "ordinal": 21,
+        "name": "draining",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -138,8 +143,9 @@
       true,
       true,
       true,
+      false,
       false
     ]
   },
-  "hash": "68bca8f839e47705b11d312ee874eceaa3d1d24d9053ad4aea94b9f8465585ca"
+  "hash": "fe22c4609d8b2472c0f83fedb92eceec2b6f1ae1a32fcf375161d04419404d9c"
 }
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index aeb7670d17..b5f3d9a306 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -6685,9 +6685,9 @@ checksum = "8bb03732005da905c88227371639bf1ad885cc712789c011c31c5fb3ab3ccf02"
 
 [[package]]
 name = "inventory"
-version = "0.3.24"
+version = "0.3.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4f0c30c76f2f4ccee3fe55a2435f691ca00c0e4bd87abe4f4a851b1d4dac39b"
+checksum = "6928282826c822ad91bf1c9a1cb90a30ba1c26770749929b4656cd6be829cd7c"
 dependencies = [
  "rustversion",
 ]
@@ -9617,7 +9617,7 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.25.15+spec-1.1.0",
+ "toml_edit 0.25.16+spec-1.1.0",
 ]
 
 [[package]]
@@ -13622,9 +13622,9 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "1.1.1+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
 dependencies = [
  "serde_core",
 ]
@@ -13644,21 +13644,21 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.25.15+spec-1.1.0"
+version = "0.25.16+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1340ea94a5856333492c9064b02c778b191dd2c853778d9609debdcdfea3a614"
+checksum = "88f38f3af8bf71841c67a990f4e2b52143b2d0a1a994c72513ff4c14977fc722"
 dependencies = [
  "indexmap 2.14.2",
- "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_datetime 1.1.2+spec-1.1.0",
  "toml_parser",
  "winnow 1.0.4",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.1.3+spec-1.1.0"
+version = "1.1.4+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+checksum = "bed810ee007d8e7f9cf20b4774e7198142fa27186e0f805871da7f3c39eaf333"
 dependencies = [
  "winnow 1.0.4",
 ]
@@ -14829,7 +14829,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14918,7 +14918,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14952,7 +14952,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14965,7 +14965,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15105,7 +15105,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15128,7 +15128,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15145,7 +15145,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15171,7 +15171,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -15181,7 +15181,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15198,7 +15198,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -15220,7 +15220,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15243,7 +15243,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15259,7 +15259,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15281,7 +15281,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15303,7 +15303,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15317,7 +15317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15353,7 +15353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15379,7 +15379,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15407,7 +15407,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15429,7 +15429,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15449,7 +15449,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15491,7 +15491,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15520,7 +15520,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15532,7 +15532,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15556,7 +15556,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15570,7 +15570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15609,7 +15609,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15624,7 +15624,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15643,7 +15643,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15757,7 +15757,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "chrono",
  "futures",
@@ -15777,7 +15777,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "regex",
  "serde",
@@ -15794,7 +15794,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15821,7 +15821,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15838,7 +15838,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15854,7 +15854,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15875,7 +15875,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15906,7 +15906,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15931,7 +15931,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15967,7 +15967,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15985,7 +15985,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15994,7 +15994,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16006,7 +16006,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16018,7 +16018,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -16030,7 +16030,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16042,7 +16042,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16054,7 +16054,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -16065,7 +16065,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -16076,7 +16076,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -16088,7 +16088,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -16099,7 +16099,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16121,7 +16121,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16133,7 +16133,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16147,7 +16147,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -16164,7 +16164,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16177,7 +16177,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -16189,7 +16189,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16207,7 +16207,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -16223,7 +16223,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -16239,7 +16239,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16253,7 +16253,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16292,7 +16292,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -16332,7 +16332,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -16343,7 +16343,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16378,7 +16378,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16402,7 +16402,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16435,7 +16435,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16462,7 +16462,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16495,7 +16495,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16515,7 +16515,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16549,7 +16549,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16586,7 +16586,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16609,7 +16609,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16633,7 +16633,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16657,7 +16657,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16692,7 +16692,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16720,7 +16720,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16745,7 +16745,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.2",
@@ -16764,7 +16764,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16883,7 +16883,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 06fdc001f0..e0b97275b2 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.827.0"
+version = "1.828.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.827.0"
+version = "1.828.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index fffcc99883..cc3c1a826c 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-1600d49ad5513af8b54ad65688d3d1c7edc977d9
\ No newline at end of file
+017710bdd0a10de857f0f40800dde238cdb1ad24
diff --git a/backend/migrations/20261008070335_worker_ping_draining.down.sql b/backend/migrations/20261008070335_worker_ping_draining.down.sql
new file mode 100644
index 0000000000..64a5f2949d
--- /dev/null
+++ b/backend/migrations/20261008070335_worker_ping_draining.down.sql
@@ -0,0 +1 @@
+ALTER TABLE worker_ping DROP COLUMN IF EXISTS draining;
diff --git a/backend/migrations/20261008070335_worker_ping_draining.up.sql b/backend/migrations/20261008070335_worker_ping_draining.up.sql
new file mode 100644
index 0000000000..33b5ad5e3e
--- /dev/null
+++ b/backend/migrations/20261008070335_worker_ping_draining.up.sql
@@ -0,0 +1 @@
+ALTER TABLE worker_ping ADD COLUMN IF NOT EXISTS draining BOOLEAN NOT NULL DEFAULT FALSE;
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 99d82bb43b..1bdbdd6097 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6216,7 +6216,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6302,7 +6302,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6314,7 +6314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6323,7 +6323,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6335,7 +6335,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6347,7 +6347,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6359,7 +6359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6371,7 +6371,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6383,7 +6383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6394,7 +6394,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6405,7 +6405,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6417,7 +6417,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6428,7 +6428,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6450,7 +6450,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6462,7 +6462,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6493,7 +6493,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6518,7 +6518,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6536,7 +6536,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6552,7 +6552,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6568,7 +6568,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6600,7 +6600,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6614,7 +6614,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.827.0"
+version = "1.828.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 9ac7f81c7f..b2fd850217 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.827.0"
+version = "1.828.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/summarized_schema.txt b/backend/summarized_schema.txt
index 2a518a7cc8..284a822b47 100644
--- a/backend/summarized_schema.txt
+++ b/backend/summarized_schema.txt
@@ -219,7 +219,7 @@ websocket_trigger: path(char), url(char), script_path(char), is_flow(bool), work
 windmill_migrations: name(text), created_at(ts)
 worker_group_job_stats: hour(bigint), worker_group(text), script_lang(char), workspace_id(char), job_count(int), total_duration_ms(bigint)
   FK: (workspace_id) -> workspace(id)
-worker_ping: worker(char), worker_instance(char), ping_at(ts), started_at(ts), ip(char), jobs_executed(int), custom_tags(text[]), worker_group(char), dedicated_worker(char), wm_version(char), current_job_id(uuid), current_job_workspace_id(char), vcpus(bigint), memory(bigint), occupancy_rate(float), memory_usage(bigint), wm_memory_usage(bigint), occupancy_rate_15s(float), occupancy_rate_5m(float), occupancy_rate_30m(float), job_isolation(text), dedicated_workers(text[])
+worker_ping: worker(char), worker_instance(char), ping_at(ts), started_at(ts), ip(char), jobs_executed(int), custom_tags(text[]), worker_group(char), dedicated_worker(char), wm_version(char), current_job_id(uuid), current_job_workspace_id(char), vcpus(bigint), memory(bigint), occupancy_rate(float), memory_usage(bigint), wm_memory_usage(bigint), occupancy_rate_15s(float), occupancy_rate_5m(float), occupancy_rate_30m(float), job_isolation(text), dedicated_workers(text[]), draining(bool)
 workspace: id(char), name(char), owner(char), deleted(bool), premium(bool), parent_workspace_id(char), is_dev_workspace(bool)
   FK: (parent_workspace_id) -> workspace(id)
 workspace_dependencies: id(bigint), name(char), content(text), language(script_lang), description(text), archived(bool), workspace_id(char), created_at(ts)
diff --git a/backend/tests/error_handler.rs b/backend/tests/error_handler.rs
index 4f58685221..b1f740566f 100644
--- a/backend/tests/error_handler.rs
+++ b/backend/tests/error_handler.rs
@@ -411,3 +411,70 @@ async fn test_error_handler_not_triggered_on_success(db: Pool<Postgres>) -> anyh
 
     Ok(())
 }
+
+/// A hub script run at the top level (a schedule, a trigger, the API) is a `script_hub` job,
+/// and its failure must reach the workspace error handler like a workspace script's.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+#[sqlx::test(fixtures("base"))]
+async fn test_error_handler_triggered_on_hub_script_failure(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_common::jobs::JobPayload;
+
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+
+    let version = "990000002";
+    let hub_dir = &*windmill_common::worker::HUB_CACHE_DIR;
+    tokio::fs::create_dir_all(hub_dir).await?;
+    tokio::fs::write(
+        format!("{hub_dir}/{version}"),
+        r#"{"content":"exit 1","lockfile":null,"language":"bash","schema":{},"summary":null}"#,
+    )
+    .await?;
+
+    // The workspace handler settings are cached per workspace id across the tests of this
+    // binary, so this reuses the handler path every other test here configures.
+    sqlx::query(
+        "INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
+         VALUES ('test-workspace', 1111111112, 'f/test/error_handler', 'echo handled', 'bash', 'script', 'test-user', '{}', '', '', '')",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        r#"UPDATE workspace_settings SET error_handler = '{"path": "script/f/test/error_handler"}'::jsonb
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    let completed_job = RunJob::from(JobPayload::ScriptHub {
+        path: format!("hub/{version}/test/fail"),
+        apply_preprocessor: false,
+    })
+    .run_until_complete(&db, false, server.addr.port())
+    .await;
+    assert!(!completed_job.success, "Hub script should have failed");
+
+    let mut handler_parent = None;
+    for _ in 0..50 {
+        handler_parent = sqlx::query_scalar::<_, Option<uuid::Uuid>>(
+            "SELECT parent_job FROM v2_job
+             WHERE workspace_id = 'test-workspace' AND permissioned_as_email = 'error_handler@windmill.dev'",
+        )
+        .fetch_optional(&db)
+        .await?;
+        if handler_parent.is_some() {
+            break;
+        }
+        tokio::time::sleep(tokio::time::Duration::from_millis(100)).await;
+    }
+    assert_eq!(
+        handler_parent,
+        Some(Some(completed_job.id)),
+        "Workspace error handler should handle the failed hub script"
+    );
+
+    Ok(())
+}
diff --git a/backend/tests/otel.rs b/backend/tests/otel.rs
index f1e042037f..30585c08a1 100644
--- a/backend/tests/otel.rs
+++ b/backend/tests/otel.rs
@@ -176,6 +176,10 @@ async fn test_all_metrics_e2e() {
     otel_set_worker_uptime("w-uptime", 3600.0);
     otel_set_health_status_phase("healthy");
     otel_set_health_db_unresponsive(true);
+    otel_set_worker_memory("w-res", "gpu", Some(512), Some(128), Some(1024));
+    otel_add_worker_cpu("w-res", "gpu", 1.5, 40, 7, 0.35);
+    otel_set_worker_occupancy_rate("w-res", "gpu", "5m", 0.25);
+    otel_record_job_memory_peak("python3", 100 * 1024 * 1024);
 
     // ── Histograms ──────────────────────────────────────────────────
 
@@ -189,7 +193,7 @@ async fn test_all_metrics_e2e() {
     let metrics = flush_and_get_metrics(&state);
     let names = metric_names(&metrics);
 
-    // ── Verify all 21 metric names are present ──────────────────────
+    // ── Verify all metric names are present ─────────────────────────
 
     let expected = [
         "windmill.queue.push_count",
@@ -213,6 +217,15 @@ async fn test_all_metrics_e2e() {
         "windmill.worker.uptime",
         "windmill.health.status",
         "windmill.health.db_unresponsive",
+        "windmill.worker.memory_usage",
+        "windmill.worker.windmill_memory_usage",
+        "windmill.worker.memory_limit",
+        "windmill.worker.cpu_usage",
+        "windmill.worker.cpu_periods",
+        "windmill.worker.cpu_throttled_periods",
+        "windmill.worker.cpu_throttled_time",
+        "windmill.worker.occupancy_rate",
+        "windmill.worker.job_memory_peak",
     ];
     for name in expected {
         assert!(
@@ -290,6 +303,18 @@ async fn test_all_metrics_e2e() {
         .expect("worker.busy data point with worker=worker-test-1 not found");
     assert_eq!(dp.1, 1);
 
+    let m = find_metric(&metrics, "windmill.worker.memory_limit").unwrap();
+    let values = gauge_i64_values(m);
+    let dp = values
+        .iter()
+        .find(|(attrs, _)| {
+            attrs
+                .iter()
+                .any(|kv| kv.key.as_str() == "worker_group" && kv.value.as_str() == "gpu")
+        })
+        .expect("worker.memory_limit data point with worker_group=gpu not found");
+    assert_eq!(dp.1, 1024);
+
     let m = find_metric(&metrics, "windmill.db.pool.active").unwrap();
     assert_eq!(gauge_i64_values(m)[0].1, 5);
     let m = find_metric(&metrics, "windmill.db.pool.idle").unwrap();
diff --git a/backend/tests/success_handler.rs b/backend/tests/success_handler.rs
index 8fc4182d9e..f876c1984b 100644
--- a/backend/tests/success_handler.rs
+++ b/backend/tests/success_handler.rs
@@ -239,3 +239,70 @@ export async function main(path: string, email: string, job_id: string, is_flow:
 
     Ok(())
 }
+
+/// A hub script run at the top level (a schedule, a trigger, the API) is a `script_hub` job,
+/// and its success must reach the workspace success handler like a workspace script's.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+#[sqlx::test(fixtures("base"))]
+async fn test_success_handler_triggered_on_hub_script_success(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_common::jobs::JobPayload;
+
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+
+    let version = "990000003";
+    let hub_dir = &*windmill_common::worker::HUB_CACHE_DIR;
+    tokio::fs::create_dir_all(hub_dir).await?;
+    tokio::fs::write(
+        format!("{hub_dir}/{version}"),
+        r#"{"content":"echo ok","lockfile":null,"language":"bash","schema":{},"summary":null}"#,
+    )
+    .await?;
+
+    // The workspace handler settings are cached per workspace id across the tests of this
+    // binary, so this reuses the handler path every other test here configures.
+    sqlx::query(
+        "INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
+         VALUES ('test-workspace', 1234567891, 'f/test/success_handler', 'echo handled', 'bash', 'script', 'test-user', '{}', '', '', '')",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        r#"UPDATE workspace_settings SET success_handler = '{"path": "script/f/test/success_handler"}'::jsonb
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    let completed_job = RunJob::from(JobPayload::ScriptHub {
+        path: format!("hub/{version}/test/ok"),
+        apply_preprocessor: false,
+    })
+    .run_until_complete(&db, false, server.addr.port())
+    .await;
+    assert!(completed_job.success, "Hub script should have succeeded");
+
+    let mut handler_parent = None;
+    for _ in 0..50 {
+        handler_parent = sqlx::query_scalar::<_, Option<uuid::Uuid>>(
+            "SELECT parent_job FROM v2_job
+             WHERE workspace_id = 'test-workspace' AND permissioned_as_email = 'success_handler@windmill.dev'",
+        )
+        .fetch_optional(&db)
+        .await?;
+        if handler_parent.is_some() {
+            break;
+        }
+        tokio::time::sleep(tokio::time::Duration::from_millis(100)).await;
+    }
+    assert_eq!(
+        handler_parent,
+        Some(Some(completed_job.id)),
+        "Workspace success handler should handle the successful hub script"
+    );
+
+    Ok(())
+}
diff --git a/backend/tests/wac_suspend_started_at.rs b/backend/tests/wac_suspend_started_at.rs
index 5a83730d24..ca364e5993 100644
--- a/backend/tests/wac_suspend_started_at.rs
+++ b/backend/tests/wac_suspend_started_at.rs
@@ -109,3 +109,91 @@ async fn wac_suspend_stands_down_for_a_cancel(db: Pool<Postgres>) -> anyhow::Res
 
     Ok(())
 }
+
+/// Each park clears `started_at`, so the completion would otherwise store only the last
+/// segment: a workflow that waited an hour on its tasks would read as a sub-second job that
+/// started an hour late. The completed row spans the workflow from its first start, and
+/// keeps the last segment aside: that is what is metered and what worker-time readers sum.
+#[sqlx::test]
+async fn wac_completion_spans_the_workflow_and_keeps_the_last_segment(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    let job_id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO v2_job (id, workspace_id, created_by, created_at, permissioned_as, \
+            permissioned_as_email, kind, script_lang, runnable_path, tag, visible_to_owner) \
+         VALUES ($1, 'test-workspace', 'test-user', now() - interval '2 hours', 'u/test-user', \
+            'test@windmill.dev', 'script', 'bun', 'u/test-user/wac', 'bun', true)",
+    )
+    .bind(job_id)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, running, tag, started_at) \
+         VALUES ($1, 'test-workspace', now(), true, 'bun', now() - interval '1 hour')",
+    )
+    .bind(job_id)
+    .execute(&db)
+    .await?;
+
+    // Two parks, each followed by the pull re-stamping `started_at`: the second park must
+    // not replace the first start with its own segment's.
+    for resumed_ago in ["10 minutes", "3 seconds"] {
+        let mut tx = db.begin().await?;
+        suspend_wac_parent(&mut tx, &job_id, "test-workspace", 1, 3600.0).await?;
+        tx.commit().await?;
+        sqlx::query(
+            "UPDATE v2_job_queue SET suspend = 0, started_at = now() - $2::text::interval \
+             WHERE id = $1",
+        )
+        .bind(job_id)
+        .bind(resumed_ago)
+        .execute(&db)
+        .await?;
+    }
+
+    let job = windmill_queue::get_mini_completed_job(&job_id, "test-workspace", &db)
+        .await?
+        .unwrap();
+    let result = serde_json::value::to_raw_value(&serde_json::json!("done"))?;
+    let (_, span) = windmill_queue::add_completed_job(
+        &db,
+        &job,
+        true,
+        false,
+        sqlx::types::Json(&result),
+        None,
+        0,
+        None,
+        false,
+        Some(3000),
+        false,
+    )
+    .await?;
+
+    let (started_ago_s, duration_ms, last_segment_ms): (f64, i64, Option<i64>) = sqlx::query_as(
+        "SELECT extract(epoch FROM now() - started_at)::float8, duration_ms, \
+                (extras->>'wac_last_segment_ms')::bigint \
+         FROM v2_job_completed WHERE id = $1",
+    )
+    .bind(job_id)
+    .fetch_one(&db)
+    .await?;
+    assert!(
+        (started_ago_s - 3600.0).abs() < 60.0,
+        "started_at must be the first start, got {started_ago_s}s ago"
+    );
+    assert!(
+        (duration_ms - 3_600_000).abs() < 60_000,
+        "duration_ms must be the wall time since the first start, got {duration_ms}"
+    );
+    assert_eq!(last_segment_ms, Some(3000));
+    assert_eq!(
+        span.duration_ms, duration_ms,
+        "a flow records the step with the span the row holds"
+    );
+    assert!(span.outlasts_run(job.started_at));
+    assert_eq!(span.last_run_ms, 3000, "only the last segment is left to meter");
+
+    Ok(())
+}
diff --git a/backend/tests/worker_ping_ip.rs b/backend/tests/worker_ping_ip.rs
index 772f4193c3..2421e888ef 100644
--- a/backend/tests/worker_ping_ip.rs
+++ b/backend/tests/worker_ping_ip.rs
@@ -2,10 +2,19 @@ use sqlx::{Pool, Postgres};
 use uuid::Uuid;
 use windmill_common::{
     external_ip::UNKNOWN_IP,
-    worker::{insert_ping_query, update_worker_ping_main_loop_query},
+    worker::{insert_ping_query, set_worker_draining_query, update_worker_ping_main_loop_query},
 };
 
 async fn insert_ping(db: &Pool<Postgres>, worker: &str, ip: Option<&str>) -> anyhow::Result<()> {
+    register(db, worker, ip, None).await
+}
+
+async fn register(
+    db: &Pool<Postgres>,
+    worker: &str,
+    ip: Option<&str>,
+    draining: Option<bool>,
+) -> anyhow::Result<()> {
     insert_ping_query(
         "test-instance",
         worker,
@@ -19,12 +28,33 @@ async fn insert_ping(db: &Pool<Postgres>, worker: &str, ip: Option<&str>) -> any
         None,
         None,
         false,
+        draining,
         db,
     )
     .await?;
     Ok(())
 }
 
+/// A worker re-registers mid-life once its external IP resolves. That registration must not
+/// clear a draining flag the same process already published; only a worker starting up under
+/// a reclaimed name resets it.
+#[sqlx::test]
+async fn only_a_starting_worker_resets_draining(db: Pool<Postgres>) -> anyhow::Result<()> {
+    let draining = || async {
+        sqlx::query_scalar::<_, bool>("SELECT draining FROM worker_ping WHERE worker = 'wk-drain'")
+            .fetch_one(&db)
+            .await
+    };
+    register(&db, "wk-drain", None, Some(false)).await?;
+    set_worker_draining_query("wk-drain", &db).await?;
+    register(&db, "wk-drain", Some("1.2.3.4"), None).await?;
+    assert!(draining().await?);
+
+    register(&db, "wk-drain", None, Some(false)).await?;
+    assert!(!draining().await?);
+    Ok(())
+}
+
 /// The external IP resolves in the background, so the initial ping often has none yet. That must
 /// not blank the address a previous process wrote to the row this one reclaims — worker names are
 /// stable across restarts under EXIT_AFTER_N_JOBS.
diff --git a/backend/windmill-ai/src/providers/mod.rs b/backend/windmill-ai/src/providers/mod.rs
index e08b038bb0..7dcddc93a3 100644
--- a/backend/windmill-ai/src/providers/mod.rs
+++ b/backend/windmill-ai/src/providers/mod.rs
@@ -62,9 +62,13 @@ const REASONING_RULES: &[ReasoningRule] = &[
         can_disable: false,
         completions_tools_need_off: false,
     },
-    // Live-verified: astra takes low..max only, where sol and luna also take `none`.
+    // Live-verified: gpt-6-astra and gpt-6.1-sol take low..max only, where gpt-6-sol and
+    // gpt-6-luna also take `none`.
     ReasoningRule {
-        matches: |m| base_id(m).starts_with("gpt-6-astra"),
+        matches: |m| {
+            let base = base_id(m);
+            base.starts_with("gpt-6-astra") || base.starts_with("gpt-6.1-sol")
+        },
         can_disable: false,
         completions_tools_need_off: true,
     },
diff --git a/backend/windmill-api-auth/src/scopes.rs b/backend/windmill-api-auth/src/scopes.rs
index dce6a0ff72..b636e11a1c 100644
--- a/backend/windmill-api-auth/src/scopes.rs
+++ b/backend/windmill-api-auth/src/scopes.rs
@@ -996,6 +996,7 @@ pub fn is_own_job_runtime_route(route_path: &str, http_method: &str, job_id: uui
         ["job_metrics", "set_progress", ..] => (http_method == "POST", 2),
         ["job_metrics", "get_progress", ..] => (http_method == "GET", 2),
         ["jobs" | "jobs_u", "resume_urls" | "wac_approval_urls", ..] => (http_method == "GET", 2),
+        ["jobs", "worker_is_draining", ..] => (http_method == "GET", 2),
         ["jobs", "wac", "inline_checkpoint", ..] => (http_method == "POST", 3),
         ["jobs", "run", "workflow_as_code", ..] => (http_method == "POST", 3),
         _ => return false,
diff --git a/backend/windmill-api-integration-tests/tests/datatable_roles.rs b/backend/windmill-api-integration-tests/tests/datatable_roles.rs
index ddb94f8c2b..9800d97841 100644
--- a/backend/windmill-api-integration-tests/tests/datatable_roles.rs
+++ b/backend/windmill-api-integration-tests/tests/datatable_roles.rs
@@ -417,6 +417,89 @@ async fn concurrent_role_creations_both_survive(db: Pool<Postgres>) -> anyhow::R
     outcome
 }
 
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn an_existing_role_is_taken_over_only_when_asked_and_never_with_members(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let suffix: String = uuid::Uuid::new_v4().simple().to_string()[..8].to_string();
+    let plain = format!("wmtest_plain_{suffix}");
+    let group = format!("wmtest_group_{suffix}");
+    let member = format!("wmtest_member_{suffix}");
+    for sql in [
+        // An expired password and no connection slot: kept as is, the login Windmill sets is dead.
+        format!(
+            "CREATE ROLE \"{plain}\" LOGIN PASSWORD 'theirs' VALID UNTIL '2000-01-01' \
+             CONNECTION LIMIT 0"
+        ),
+        format!("CREATE ROLE \"{group}\" NOLOGIN"),
+        format!("CREATE ROLE \"{member}\" LOGIN"),
+        format!("GRANT \"{group}\" TO \"{member}\""),
+    ] {
+        sqlx::query(&sql).execute(&db).await?;
+    }
+
+    let create = |name: String, take_over: bool| async move {
+        let resp = authed(
+            client().post(format!(
+                "http://localhost:{port}/api/settings/datatable_roles"
+            )),
+            "SECRET_TOKEN",
+        )
+        .json(&json!({ "name": name, "take_over": take_over }))
+        .send()
+        .await?;
+        Ok::<_, anyhow::Error>((resp.status().as_u16(), resp.text().await?))
+    };
+    let outcome = async {
+        let (status, body) = create(plain.clone(), false).await?;
+        assert_eq!(
+            status, 409,
+            "an existing role is not taken without asking: {body}"
+        );
+
+        // The group's member would inherit every grant the data table role gets.
+        let (status, body) = create(group.clone(), true).await?;
+        assert_eq!(status, 400, "{body}");
+        assert!(
+            body.contains(&member),
+            "the refusal names the member: {body}"
+        );
+
+        let (status, body) = create(plain.clone(), true).await?;
+        assert_eq!(status, 200, "{body}");
+        let catalog = windmill_common::datatable_roles::read_role_catalog(
+            &db,
+            windmill_common::datatable_roles::DatatableRoleCluster::Instance,
+        )
+        .await?;
+        let taken = catalog
+            .values()
+            .find(|r| r.name == plain)
+            .ok_or_else(|| anyhow::anyhow!("{plain} is not in the catalog: {catalog:?}"))?;
+        let options = (*db.connect_options())
+            .clone()
+            .username(&plain)
+            .password(taken.pwd.as_deref().unwrap_or_default());
+        let mut login = <sqlx::PgConnection as sqlx::Connection>::connect_with(&options).await?;
+        sqlx::query("SELECT 1").execute(&mut login).await?;
+        Ok::<_, anyhow::Error>(())
+    }
+    .await;
+
+    // Roles are cluster-wide and outlive this test's database, whatever happened above.
+    for name in [&member, &group, &plain] {
+        let _ = sqlx::query(&format!("DROP ROLE IF EXISTS \"{name}\""))
+            .execute(&db)
+            .await;
+    }
+    outcome
+}
+
 #[cfg(all(feature = "private", feature = "enterprise"))]
 #[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
 async fn a_role_delete_that_fails_part_way_leaves_the_role_disabled(
diff --git a/backend/windmill-api-integration-tests/tests/jobs_authed.rs b/backend/windmill-api-integration-tests/tests/jobs_authed.rs
index c3da2f3fb9..2c5d2ee78e 100644
--- a/backend/windmill-api-integration-tests/tests/jobs_authed.rs
+++ b/backend/windmill-api-integration-tests/tests/jobs_authed.rs
@@ -702,3 +702,51 @@ async fn test_list_filtered_job_uuids_resolved_excludes_queue(
 
     Ok(())
 }
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_worker_is_draining_follows_the_job_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let job = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO v2_job (id, workspace_id, created_by, permissioned_as, kind, tag, args)
+         VALUES ($1, 'test-workspace', 'test-user', 'u/test-user', 'script', 'deno', '{}'::jsonb)",
+    )
+    .bind(job)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag, running, started_at, worker)
+         VALUES ($1, 'test-workspace', now(), 'deno', true, now(), 'wk-drain-test')",
+    )
+    .bind(job)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO worker_ping (worker, worker_instance, ip, worker_group, wm_version)
+         VALUES ('wk-drain-test', 'host', 'NO IP', 'default', 'v0')",
+    )
+    .execute(&db)
+    .await?;
+
+    let url = format!("http://localhost:{port}/api/w/test-workspace/jobs/worker_is_draining/{job}");
+    let draining = || async {
+        let resp = authed(client().get(&url)).send().await?;
+        anyhow::Ok(resp.json::<bool>().await?)
+    };
+    assert!(!draining().await?);
+
+    windmill_common::worker::set_worker_draining_query("wk-drain-test", &db).await?;
+    assert!(draining().await?);
+
+    // A parked job keeps its last worker on the queue row without running on it.
+    sqlx::query("UPDATE v2_job_queue SET started_at = NULL WHERE id = $1")
+        .bind(job)
+        .execute(&db)
+        .await?;
+    assert!(!draining().await?);
+
+    Ok(())
+}
diff --git a/backend/windmill-api-jobs/src/execution.rs b/backend/windmill-api-jobs/src/execution.rs
index 5e08949138..ce6cfc185d 100644
--- a/backend/windmill-api-jobs/src/execution.rs
+++ b/backend/windmill-api-jobs/src/execution.rs
@@ -33,6 +33,7 @@ use windmill_common::{
     flow_conversations::{
         add_message_to_conversation_tx, message_attachments, MessageExtras, MessageType,
     },
+    flows::Retry,
     get_latest_flow_version_info_for_path,
     jobs::{
         check_tag_available_for_workspace_internal, format_result, script_path_to_payload,
@@ -126,6 +127,71 @@ pub async fn drop_unclaimable_run_lineage(
     Ok(())
 }
 
+/// Applies the run's `retry` policy by handing `push` a one-step-flow request, which it
+/// materializes as a native retryable `Script`.
+pub fn with_run_retry(
+    run_query: &RunJobQuery,
+    payload: JobPayload,
+    args: &PushArgs<'_>,
+    tag: &Option<String>,
+) -> error::Result<JobPayload> {
+    let Some(retry) = run_query.retry.as_deref() else {
+        return Ok(payload);
+    };
+    // Retry attempts are always pushed visible to the owner, which would leak a private run.
+    if run_query.invisible_to_owner.unwrap_or(false) {
+        return Err(Error::BadRequest(
+            "retry cannot be combined with invisible_to_owner".to_string(),
+        ));
+    }
+    let retry: Retry = serde_json::from_str(retry)
+        .map_err(|e| Error::BadRequest(format!("invalid retry policy: {e}")))?;
+    let JobPayload::ScriptHash {
+        hash,
+        path,
+        cache_ttl,
+        cache_ignore_s3_path,
+        language,
+        priority,
+        apply_preprocessor,
+        debouncing_settings,
+        concurrency_settings,
+        ..
+    } = payload
+    else {
+        return Err(Error::BadRequest(
+            "retry is only supported for workspace scripts".to_string(),
+        ));
+    };
+    // A failed attempt keeps its raw args and the retry re-push skips the preprocessor, so
+    // every retry would call `main` with un-preprocessed input.
+    if apply_preprocessor {
+        return Err(Error::BadRequest(
+            "retry is not supported for a script with a preprocessor unless skip_preprocessor is set"
+                .to_string(),
+        ));
+    }
+    Ok(JobPayload::SingleStepFlow {
+        path,
+        hash: Some(hash),
+        flow_version: None,
+        language: Some(language),
+        args: HashMap::from(args),
+        retry: Some(retry),
+        error_handler_path: None,
+        error_handler_args: None,
+        skip_handler: None,
+        cache_ttl,
+        cache_ignore_s3_path,
+        priority,
+        tag_override: tag.clone(),
+        trigger_path: None,
+        apply_preprocessor,
+        concurrency_settings,
+        debouncing_settings,
+    })
+}
+
 /// The jobs of `referenced` that `authed` cannot claim as its own run lineage: anything but the
 /// token's own job and that job's `parent_job`, `root_job` and `flow_innermost_root_job`, or for
 /// a workspace admin anything outside the workspace. A restricted job token never gets the admin
@@ -1151,6 +1217,7 @@ pub async fn push_script_job_by_path_into_queue<'c>(
     let tag = run_query.tag.clone().or(tag);
     let push_args = PushArgs { args: &args.args, extra: args.extra };
     check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, &authed).await?;
+    let job_payload = with_run_retry(&run_query, job_payload, &push_args, &tag)?;
 
     let return_tx = tx_o.is_some();
 
diff --git a/backend/windmill-api-jobs/src/types.rs b/backend/windmill-api-jobs/src/types.rs
index f37040bd11..f50cb61451 100644
--- a/backend/windmill-api-jobs/src/types.rs
+++ b/backend/windmill-api-jobs/src/types.rs
@@ -52,6 +52,8 @@ pub struct RunJobQuery {
     pub trigger_external_id: Option<String>,
     pub service_name: Option<String>,
     pub suspended_mode: Option<bool>,
+    /// A JSON-encoded `Retry` policy for a script run; see `with_run_retry`.
+    pub retry: Option<String>,
 }
 
 impl RunJobQuery {
diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index c79b596617..f9f0a993fa 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -58,10 +58,10 @@ use windmill_common::{
     error::{self, pg_error_message, JsonResult, Result},
     get_database_url,
     global_settings::{
-        ACCENT_COLOR_SETTING, AI_CONFIG_SETTING, APP_WORKSPACED_ROUTE_SETTING,
-        AUTOMATE_USERNAME_CREATION_SETTING, CRITICAL_ALERT_MUTE_UI_SETTING, CUSTOM_TAGS_SETTING,
-        DEFAULT_TAGS_WORKSPACES_SETTING, DISABLE_HUB_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS,
-        EXTERNAL_INSTANCE_PG_SETTING,
+        ACCENT_COLOR_SETTING, AI_CONFIG_SETTING, API_BASE_URL_SETTING,
+        APP_WORKSPACED_ROUTE_SETTING, AUTOMATE_USERNAME_CREATION_SETTING,
+        CRITICAL_ALERT_MUTE_UI_SETTING, CUSTOM_TAGS_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING,
+        DISABLE_HUB_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS, EXTERNAL_INSTANCE_PG_SETTING,
         GITHUB_APP_WEBHOOK_BASE_URL_SETTING, HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING,
         HTTP_ROUTE_WORKSPACED_ROUTE_SETTING, HUB_ACCESSIBLE_URL_SETTING, HUB_BASE_URL_SETTING,
         INSTANCE_BANNER_SETTING, MAX_RETENTION_OVERRIDE_WORKSPACES,
@@ -1238,26 +1238,22 @@ async fn run_setting_pre_write_hook(
                 }
             }
         }
-        GITHUB_APP_WEBHOOK_BASE_URL_SETTING => {
-            // A bad value here yields a webhook GitHub can never deliver to, and the
+        GITHUB_APP_WEBHOOK_BASE_URL_SETTING | API_BASE_URL_SETTING => {
+            // A bad webhook base yields a webhook GitHub can never deliver to, and the
             // failure only shows up much later as "falling back to polling" on a
-            // repository — so reject it at the boundary instead.
+            // repository; a bad API base puts an unreachable URL in front of every user.
+            // So reject both at the boundary instead.
             match value {
                 // Clearing (delete row) is handled by the caller; allow it through.
                 serde_json::Value::Null => {}
                 serde_json::Value::String(s) if s.trim().is_empty() => {}
                 serde_json::Value::String(s) => {
-                    windmill_common::global_settings::validate_webhook_base_url(s).map_err(
-                        |e| {
-                            error::Error::BadRequest(format!(
-                                "{GITHUB_APP_WEBHOOK_BASE_URL_SETTING}: {e}"
-                            ))
-                        },
-                    )?;
+                    windmill_common::global_settings::validate_webhook_base_url(s)
+                        .map_err(|e| error::Error::BadRequest(format!("{key}: {e}")))?;
                 }
                 _ => {
                     return Err(error::Error::BadRequest(format!(
-                        "{GITHUB_APP_WEBHOOK_BASE_URL_SETTING} must be a URL string"
+                        "{key} must be a URL string"
                     )));
                 }
             }
@@ -1394,8 +1390,12 @@ async fn set_instance_config(
 
         // Applied and audited one setting at a time: the writes are not transactional, so a
         // batch that fails midway must not leave the settings it did write unrecorded.
-        let instance_config::SettingsDiff { upserts, deletes, mut previous_values, unchanged_count } =
-            settings_diff;
+        let instance_config::SettingsDiff {
+            upserts,
+            deletes,
+            mut previous_values,
+            unchanged_count,
+        } = settings_diff;
         let steps = upserts
             .into_iter()
             .map(|(k, v)| (k, Some(v)))
diff --git a/backend/windmill-api-users/src/users.rs b/backend/windmill-api-users/src/users.rs
index ac9defcd53..46bd6825e8 100644
--- a/backend/windmill-api-users/src/users.rs
+++ b/backend/windmill-api-users/src/users.rs
@@ -490,7 +490,7 @@ async fn list_user_usage(
             "
     SELECT usr.email, usage.executions
         FROM usr, LATERAL (
-            SELECT COALESCE(SUM(c.duration_ms + 1000)/1000 , 0)::BIGINT executions
+            SELECT COALESCE(SUM(COALESCE((c.extras->>'wac_last_segment_ms')::bigint, c.duration_ms) + 1000)/1000 , 0)::BIGINT executions
                 FROM v2_job_completed c JOIN v2_job j USING (id)
                 WHERE j.workspace_id = $1
                 AND j.kind NOT IN ('flow', 'flowpreview', 'flownode', 'singlestepflow')
diff --git a/backend/windmill-api-workers/src/lib.rs b/backend/windmill-api-workers/src/lib.rs
index 0102f1b033..cf0b85609a 100644
--- a/backend/windmill-api-workers/src/lib.rs
+++ b/backend/windmill-api-workers/src/lib.rs
@@ -86,6 +86,7 @@ struct WorkerPing {
     job_isolation: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     native_mode: Option<bool>,
+    draining: bool,
 }
 
 // #[derive(Serialize, Deserialize)]
@@ -118,7 +119,7 @@ async fn list_worker_pings(
         WorkerPing,
         "SELECT worker, worker_instance,  EXTRACT(EPOCH FROM (now() - ping_at))::integer as last_ping, started_at, ip, jobs_executed,
         CASE WHEN $4 IS TRUE THEN current_job_id ELSE NULL END as last_job_id, CASE WHEN $4 IS TRUE THEN current_job_workspace_id ELSE NULL END as last_job_workspace_id,
-        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage, job_isolation, native_mode
+        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage, job_isolation, native_mode, draining
         FROM worker_ping
         WHERE ($1::integer IS NULL AND ping_at > now() - interval '5 minute') OR (ping_at > now() - ($1 || ' seconds')::interval)
         ORDER BY ping_at desc LIMIT $2 OFFSET $3",
diff --git a/backend/windmill-api-workspaces/src/datatable_acl.rs b/backend/windmill-api-workspaces/src/datatable_acl.rs
index ebab6214ce..efaa712481 100644
--- a/backend/windmill-api-workspaces/src/datatable_acl.rs
+++ b/backend/windmill-api-workspaces/src/datatable_acl.rs
@@ -683,6 +683,9 @@ pub(crate) struct CatalogFacts {
     pub(crate) former_owner: Option<FormerOwnerDefaults>,
     /// For a revoke: each grant it takes back.
     pub(crate) revoked_grants: Vec<RevokedGrant>,
+    /// For a grant on what a schema holds: the role cannot reach the schema yet, so the grant
+    /// would give it nothing it can use.
+    pub(crate) lacks_schema_usage: bool,
 }
 
 /// A grant a revoke takes back, as the catalog records it: what `source` gave on `object` (the
@@ -1526,7 +1529,24 @@ async fn build_plan(
             )));
         }
     }
-    let facts = CatalogFacts { other_pg_roles, existing_objects, former_owner, revoked_grants };
+    let lacks_schema_usage = match (&change, target) {
+        (AclChange::Grant { scope, .. }, AclTarget::Schema { schema })
+            if !matches!(scope, GrantScope::Target) =>
+        {
+            !has_schema_usage(client, schema, &pg_role).await?
+        }
+        (AclChange::Grant { .. }, AclTarget::Table { schema, .. }) => {
+            !has_schema_usage(client, schema, &pg_role).await?
+        }
+        _ => false,
+    };
+    let facts = CatalogFacts {
+        other_pg_roles,
+        existing_objects,
+        former_owner,
+        revoked_grants,
+        lacks_schema_usage,
+    };
     let mut plan =
         crate::datatable_acl_oss::plan_statements(target, &change, dbname, &pg_role, &facts)?;
     if matches!(change, AclChange::SetOwner { .. }) {
@@ -1540,6 +1560,27 @@ async fn build_plan(
     Ok(plan)
 }
 
+/// Whether `pg_role` may look into `schema`, directly or through a role it inherits from.
+async fn has_schema_usage(
+    client: &tokio_postgres::Client,
+    schema: &str,
+    pg_role: &str,
+) -> Result<bool> {
+    Ok(client
+        .query_one(
+            "SELECT has_schema_privilege($1::name, $2::text, 'USAGE')",
+            &[&pg_role, &schema],
+        )
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to read the role's privileges on schema {schema}: {}",
+                pg_error_message(&e)
+            ))
+        })?
+        .get(0))
+}
+
 /// Postgres only hands an object to a role that could have created it: a table to one with
 /// `CREATE` on its schema, a schema to one with `CREATE` on the database.
 async fn missing_owner_privilege(
diff --git a/backend/windmill-api/openapi-deref.json b/backend/windmill-api/openapi-deref.json
index 8dae1bafcd..4016222d30 100644
--- a/backend/windmill-api/openapi-deref.json
+++ b/backend/windmill-api/openapi-deref.json
@@ -34993,7 +34993,7 @@
           },
           "exponential": {
             "type": "object",
-            "description": "Retry with exponential backoff (delay doubles each time)",
+            "description": "Retry with exponential backoff: the n-th retry waits multiplier × seconds^n",
             "properties": {
               "attempts": {
                 "type": "integer",
@@ -35006,7 +35006,7 @@
               "seconds": {
                 "type": "integer",
                 "minimum": 1,
-                "description": "Initial delay in seconds"
+                "description": "Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too"
               },
               "random_factor": {
                 "type": "integer",
@@ -47930,7 +47930,7 @@
           },
           "exponential": {
             "type": "object",
-            "description": "Retry with exponential backoff (delay doubles each time)",
+            "description": "Retry with exponential backoff: the n-th retry waits multiplier × seconds^n",
             "properties": {
               "attempts": {
                 "type": "integer",
@@ -47943,7 +47943,7 @@
               "seconds": {
                 "type": "integer",
                 "minimum": 1,
-                "description": "Initial delay in seconds"
+                "description": "Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too"
               },
               "random_factor": {
                 "type": "integer",
diff --git a/backend/windmill-api/openapi-deref.yaml b/backend/windmill-api/openapi-deref.yaml
index 439e4d11a0..d541144231 100644
--- a/backend/windmill-api/openapi-deref.yaml
+++ b/backend/windmill-api/openapi-deref.yaml
@@ -11725,9 +11725,7 @@ paths:
                                           description: Seconds to wait between retries
                                     exponential:
                                       type: object
-                                      description: >-
-                                        Retry with exponential backoff (delay
-                                        doubles each time)
+                                      description: 'Retry with exponential backoff: the n-th retry waits multiplier × seconds^n'
                                       properties:
                                         attempts:
                                           type: integer
@@ -11738,7 +11736,7 @@ paths:
                                         seconds:
                                           type: integer
                                           minimum: 1
-                                          description: Initial delay in seconds
+                                          description: Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too
                                         random_factor:
                                           type: integer
                                           minimum: 0
@@ -23272,7 +23270,7 @@ paths:
                           description: Seconds to wait between retries
                     exponential:
                       type: object
-                      description: Retry with exponential backoff (delay doubles each time)
+                      description: 'Retry with exponential backoff: the n-th retry waits multiplier × seconds^n'
                       properties:
                         attempts:
                           type: integer
@@ -23283,7 +23281,7 @@ paths:
                         seconds:
                           type: integer
                           minimum: 1
-                          description: Initial delay in seconds
+                          description: Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too
                         random_factor:
                           type: integer
                           minimum: 0
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 51d2fbcb81..b6ce4ced20 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.827.0
+  version: 1.828.0
   title: Windmill API
 
   contact:
@@ -1765,6 +1765,12 @@ paths:
                   type: string
                 cluster:
                   $ref: "#/components/schemas/DatatableRoleCluster"
+                take_over:
+                  type: boolean
+                  description: >
+                    manage a Postgres role of that name that already exists on the cluster,
+                    replacing its password, instead of refusing it. A role with cluster-wide
+                    attributes or memberships is refused either way
       responses:
         "200":
           description: the created role
@@ -1772,6 +1778,8 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/InstanceDatatableRole"
+        "409":
+          description: a Postgres role of that name already exists on the cluster and take_over was not set
 
   /settings/datatable_roles/{id}:
     post:
@@ -1911,7 +1919,7 @@ paths:
 
   /settings/instance_ui:
     get:
-      summary: get the instance-wide announcement banner and accent color
+      summary: get the instance-wide announcement banner, accent color and API base url
       description: |
         Readable by any authenticated user; every page load reads it. Each value
         is the raw stored setting, or null when unset.
@@ -1920,7 +1928,7 @@ paths:
         - setting
       responses:
         "200":
-          description: the instance_banner and accent_color settings
+          description: the instance_banner, accent_color and api_base_url settings
           content:
             application/json:
               schema:
@@ -1928,6 +1936,7 @@ paths:
                 properties:
                   instance_banner: {}
                   accent_color: {}
+                  api_base_url: {}
 
   /settings_u/ruff_config:
     get:
@@ -12004,6 +12013,7 @@ paths:
         - $ref: "#/components/parameters/WorkerTag"
         - $ref: "#/components/parameters/CacheTtl"
         - $ref: "#/components/parameters/NewJobId"
+        - $ref: "#/components/parameters/RunRetry"
         - name: invisible_to_owner
           description: make the run invisible to the the script owner (default false)
           in: query
@@ -16053,6 +16063,7 @@ paths:
         - $ref: "#/components/parameters/WorkerTag"
         - $ref: "#/components/parameters/CacheTtl"
         - $ref: "#/components/parameters/NewJobId"
+        - $ref: "#/components/parameters/RunRetry"
         - $ref: "#/components/parameters/IncludeHeader"
         - name: invisible_to_owner
           description: make the run invisible to the the script owner (default false)
@@ -17357,6 +17368,27 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/jobs/worker_is_draining/{id}:
+    get:
+      summary: whether the worker running this job is draining
+      description: |
+        True once the worker running the job has received its shutdown signal. The worker
+        still waits for the job to finish, so a long-running job can poll this to exit early.
+        False when the job is not currently running on a worker.
+      operationId: workerIsDraining
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/JobId"
+      responses:
+        "200":
+          description: whether the worker running this job is draining
+          content:
+            application/json:
+              schema:
+                type: boolean
+
   /w/{workspace}/jobs_u/get_logs/{id}:
     get:
       summary: get job logs
@@ -27867,6 +27899,12 @@ components:
       in: query
       schema:
         type: string
+    RunRetry:
+      name: retry
+      description: JSON-encoded retry policy (same shape as a schedule's retry) re-running the job when it fails. The returned id is the first attempt's; each retry is a job of its own, recorded as a child of the first attempt. Not supported for hub scripts, with invisible_to_owner, or for a script whose preprocessor would run.
+      in: query
+      schema:
+        type: string
     NewJobId:
       name: job_id
       description:
@@ -34627,6 +34665,11 @@ components:
           type: boolean
         cluster:
           $ref: "#/components/schemas/DatatableRoleCluster"
+        in_use:
+          type: boolean
+          description: >-
+            Whether any data table, in any workspace, lets someone connect as this role. Only set
+            in a data table's available_roles.
 
     DatatableRoleTenants:
       type: object
@@ -35982,6 +36025,9 @@ components:
           type: string
         native_mode:
           type: boolean
+        draining:
+          type: boolean
+          description: the worker received its shutdown signal and exits once its current job is done
       required:
         - worker
         - worker_instance
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index f276e6d143..26b369ce74 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -979,7 +979,14 @@ async fn get_raw_app_data(
             // the opaque, sandboxed wrapper (incl. under a cross-origin-isolated
             // / COEP `require-corp` embedder).
             .header("X-Content-Type-Options", "nosniff")
-            .header("Cross-Origin-Resource-Policy", "cross-origin");
+            .header("Cross-Origin-Resource-Policy", "cross-origin")
+            // The secret names one app version, whose bundle is written once at deploy,
+            // so the URL's content never changes. `private`: the URL is a capability, so
+            // shared caches must not keep serving it after the app is deleted.
+            .header(
+                http::header::CACHE_CONTROL,
+                "private, max-age=31536000, immutable",
+            );
         Ok(res.body(body).unwrap())
     } else {
         return Err(Error::NotFound("File not found".to_string()));
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index b08b083695..5b0da21c50 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -378,6 +378,10 @@ pub fn workspaced_service() -> Router {
             "/wac_approval_urls/{job_id}/{step_key}",
             get(get_wac_approval_urls).layer(cors.clone()),
         )
+        .route(
+            "/worker_is_draining/{id}",
+            get(worker_is_draining).layer(cors.clone()),
+        )
         .route(
             "/result_by_id/{job_id}/{node_id}",
             get(get_result_by_id).layer(cors.clone()),
@@ -613,6 +617,53 @@ async fn get_root_job(
     Ok(Json(res))
 }
 
+/// Whether the worker running this job has received its shutdown signal. A draining worker
+/// never interrupts its job, so a long-running script polls this to exit on its own terms.
+async fn worker_is_draining(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, id)): Path<(String, Uuid)>,
+) -> windmill_common::error::JsonResult<bool> {
+    // A job always may ask about itself. Anyone else must be able to see the job: the
+    // caller's row policies on v2_job decide, narrowed by the token's tag filter.
+    let draining = if authed.job_id == Some(id) {
+        sqlx::query_scalar!(
+            "SELECT wp.draining FROM v2_job_queue q JOIN worker_ping wp ON wp.worker = q.worker
+            WHERE q.id = $1 AND q.workspace_id = $2 AND q.running AND q.started_at IS NOT NULL",
+            id,
+            w_id
+        )
+        .fetch_optional(&db)
+        .await?
+    } else {
+        let tags = get_scope_tags(&authed)
+            .map(|tags| tags.into_iter().map(str::to_string).collect::<Vec<_>>());
+        let mut tx = user_db.begin(&authed).await?;
+        let draining = sqlx::query_scalar!(
+            "SELECT wp.draining FROM v2_job j
+            JOIN v2_job_queue q ON q.id = j.id
+            JOIN worker_ping wp ON wp.worker = q.worker
+            WHERE j.id = $1 AND j.workspace_id = $2 AND q.running AND q.started_at IS NOT NULL
+            AND ($3::text[] IS NULL OR j.tag = ANY($3))",
+            id,
+            w_id,
+            tags.as_deref()
+        )
+        .fetch_optional(&mut *tx)
+        .await?;
+        tx.commit().await?;
+        draining
+    }
+    .unwrap_or(false);
+    windmill_common::feature_usage::log_feature_usage(
+        "worker_draining",
+        "check",
+        if draining { "draining" } else { "not_draining" },
+    );
+    Ok(Json(draining))
+}
+
 async fn compute_root_job_for_flow(db: &DB, w_id: &str, job_id: Uuid) -> error::Result<String> {
     let root_job = sqlx::query_scalar!(
             r#"SELECT COALESCE(root_job, flow_innermost_root_job, parent_job, id) as "root_job!" FROM v2_job WHERE id = $1 AND workspace_id = $2"#,
@@ -8541,6 +8592,11 @@ pub async fn stream_job(
     run_query: RunJobQuery,
     is_get: bool,
 ) -> error::Result<Response> {
+    if run_query.retry.is_some() {
+        return Err(error::Error::BadRequest(
+            "retry is only supported when running a script asynchronously".to_string(),
+        ));
+    }
     let args = if is_get {
         let payload_as_args = run_query.payload_as_args()?;
 
@@ -10483,26 +10539,29 @@ pub async fn run_job_by_hash_inner(
         )
     };
 
+    let job_payload = JobPayload::ScriptHash {
+        hash: ScriptHash(hash),
+        path: path,
+        concurrency_settings,
+        debouncing_settings,
+        cache_ttl,
+        cache_ignore_s3_path,
+        language,
+        dedicated_worker,
+        priority,
+        apply_preprocessor: !run_query.skip_preprocessor.unwrap_or(false)
+            && has_preprocessor.unwrap_or(false),
+        labels,
+        job_token_scopes,
+    };
+    let job_payload = with_run_retry(&run_query, job_payload, &push_args, &tag)?;
+
     let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
     let (uuid, tx) = push(
         &db,
         tx,
         &w_id,
-        JobPayload::ScriptHash {
-            hash: ScriptHash(hash),
-            path: path,
-            concurrency_settings,
-            debouncing_settings,
-            cache_ttl,
-            cache_ignore_s3_path,
-            language,
-            dedicated_worker,
-            priority,
-            apply_preprocessor: !run_query.skip_preprocessor.unwrap_or(false)
-                && has_preprocessor.unwrap_or(false),
-            labels,
-            job_token_scopes,
-        },
+        job_payload,
         push_args,
         authed.display_username(),
         email,
diff --git a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
index 1962710578..73b1fd1792 100644
--- a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
+++ b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
@@ -2024,7 +2024,7 @@ You should get the schema of the script or flow before creating the schedule to
                                 },
                                 "exponential": {
                                         "type": "object",
-                                        "description": "Retry with exponential backoff (delay doubles each time)",
+                                        "description": "Retry with exponential backoff: the n-th retry waits multiplier × seconds^n",
                                         "properties": {
                                                 "attempts": {
                                                         "type": "integer",
@@ -2037,7 +2037,7 @@ You should get the schema of the script or flow before creating the schedule to
                                                 "seconds": {
                                                         "type": "integer",
                                                         "minimum": 1,
-                                                        "description": "Initial delay in seconds"
+                                                        "description": "Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too"
                                                 },
                                                 "random_factor": {
                                                         "type": "integer",
@@ -2231,7 +2231,7 @@ You should get the schema of the script or flow before updating the schedule to
                                 },
                                 "exponential": {
                                         "type": "object",
-                                        "description": "Retry with exponential backoff (delay doubles each time)",
+                                        "description": "Retry with exponential backoff: the n-th retry waits multiplier × seconds^n",
                                         "properties": {
                                                 "attempts": {
                                                         "type": "integer",
@@ -2244,7 +2244,7 @@ You should get the schema of the script or flow before updating the schedule to
                                                 "seconds": {
                                                         "type": "integer",
                                                         "minimum": 1,
-                                                        "description": "Initial delay in seconds"
+                                                        "description": "Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too"
                                                 },
                                                 "random_factor": {
                                                         "type": "integer",
diff --git a/backend/windmill-common/src/datatable_roles.rs b/backend/windmill-common/src/datatable_roles.rs
index f355e733cb..e7e490a6a4 100644
--- a/backend/windmill-common/src/datatable_roles.rs
+++ b/backend/windmill-common/src/datatable_roles.rs
@@ -331,6 +331,12 @@ pub async fn converge_connect_grants_with(
 /// `CREATE ROLE <name> LOGIN PASSWORD ...; GRANT <name> TO custom_instance_user` on `cluster`. No
 /// privileges beyond that — an admin grants them through SQL or the ACL editor.
 ///
+/// A role of that name that already exists is refused with a 409, unless `take_over`: then its
+/// password is replaced and it is managed from here on like one created here. A role holding
+/// cluster-wide privileges, or inheriting another role's, is refused either way, since every tenant
+/// would get them. Returns whether an existing role was taken over: undoing a failed take-over
+/// must not drop a role that was there before.
+///
 /// On Windmill's own cluster the DDL runs on `tx`, so it commits with the catalog row. The external
 /// cluster is another server: the role is created there before `tx` commits, and callers MUST drop
 /// it again ([`drop_datatable_role`]) if `tx` then fails to commit.
@@ -343,8 +349,10 @@ pub async fn create_datatable_role(
     cluster: DatatableRoleCluster,
     name: &str,
     password: &str,
-) -> Result<()> {
-    crate::datatable_roles_oss::create_datatable_role(db, tx, cluster, name, password).await
+    take_over: bool,
+) -> Result<bool> {
+    crate::datatable_roles_oss::create_datatable_role(db, tx, cluster, name, password, take_over)
+        .await
 }
 
 /// Authorization: alters a cluster-wide Postgres login. Callers MUST restrict this to superadmin
diff --git a/backend/windmill-common/src/datatable_roles_oss.rs b/backend/windmill-common/src/datatable_roles_oss.rs
index a97a936827..33d711e7f9 100644
--- a/backend/windmill-common/src/datatable_roles_oss.rs
+++ b/backend/windmill-common/src/datatable_roles_oss.rs
@@ -125,7 +125,8 @@ mod ce {
         _cluster: DatatableRoleCluster,
         _name: &str,
         _password: &str,
-    ) -> Result<()> {
+        _take_over: bool,
+    ) -> Result<bool> {
         Err(unavailable())
     }
 
diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs
index e1a731f3e6..1cd3609820 100644
--- a/backend/windmill-common/src/global_settings.rs
+++ b/backend/windmill-common/src/global_settings.rs
@@ -181,6 +181,12 @@ pub const GITHUB_ENTERPRISE_APP_SETTING: &str = "github_enterprise_app";
 /// `base_url` when unset; set it when the browser-facing URL is not reachable
 /// from GitHub and a separate ingress fronts the API for inbound webhooks.
 pub const GITHUB_APP_WEBHOOK_BASE_URL_SETTING: &str = "github_app_webhook_base_url";
+/// Base URL the UI shows for the endpoints external clients call (webhooks, HTTP
+/// routes, push trigger endpoints, the CLI), instead of the origin the UI is browsed on.
+/// For deployments that serve the API on a separate domain or behind a gateway.
+/// EE only. Readable by any authenticated user, like [`INSTANCE_BANNER_SETTING`]:
+/// every user is shown URLs built from it.
+pub const API_BASE_URL_SETTING: &str = "api_base_url";
 /// Instance-wide announcement rendered above every page of the app (maintenance
 /// windows, incidents). Readable by any authenticated user, unlike most settings:
 /// the banner exists to be shown to everyone, so it must never hold anything the
@@ -313,12 +319,17 @@ pub fn validate_accent_color(value: &serde_json::Value) -> Result<(), String> {
 pub struct InstanceUi {
     pub instance_banner: Option<serde_json::Value>,
     pub accent_color: Option<serde_json::Value>,
+    pub api_base_url: Option<serde_json::Value>,
 }
 
 pub async fn get_instance_ui(db: &Pool<Postgres>) -> error::Result<InstanceUi> {
     let rows = sqlx::query!(
         "SELECT name, value FROM global_settings WHERE name = ANY($1)",
-        &[INSTANCE_BANNER_SETTING, ACCENT_COLOR_SETTING] as &[&str]
+        &[
+            INSTANCE_BANNER_SETTING,
+            ACCENT_COLOR_SETTING,
+            API_BASE_URL_SETTING
+        ] as &[&str]
     )
     .fetch_all(db)
     .await?;
@@ -327,17 +338,22 @@ pub async fn get_instance_ui(db: &Pool<Postgres>) -> error::Result<InstanceUi> {
         match row.name.as_str() {
             INSTANCE_BANNER_SETTING => ui.instance_banner = Some(row.value),
             ACCENT_COLOR_SETTING => ui.accent_color = Some(row.value),
+            API_BASE_URL_SETTING => ui.api_base_url = Some(row.value),
             _ => {}
         }
     }
     Ok(ui)
 }
 
-/// Validate a [`GITHUB_APP_WEBHOOK_BASE_URL_SETTING`] value.
+const SHELL_ACTIVE_CHARS: [char; 16] = [
+    '$', '`', '\'', '"', '\\', ';', '&', '|', '<', '>', '(', ')', '{', '}', '*', '!',
+];
+
+/// Validate a [`GITHUB_APP_WEBHOOK_BASE_URL_SETTING`] or [`API_BASE_URL_SETTING`] value.
 ///
-/// The receiver path is appended to it verbatim, so anything that doesn't
-/// concatenate into a URL GitHub can POST to must be rejected at write time
-/// rather than silently producing an unreachable hook: a wrong scheme
+/// A path is appended to it verbatim, so anything that doesn't concatenate into a
+/// URL an external caller can reach must be rejected at write time rather than
+/// silently producing an unreachable hook or endpoint: a wrong scheme
 /// (`httpss://`), a missing host, embedded whitespace, or a query/fragment
 /// (appending a path after `?`/`#` keeps it inside the query/fragment).
 ///
@@ -353,7 +369,7 @@ pub fn validate_webhook_base_url(value: &str) -> Result<(), String> {
         url::Url::parse(value).map_err(|e| format!("must be an absolute http(s) URL: {e}"))?;
     if !url.username().is_empty() || url.password().is_some() {
         return Err(
-            "must not embed a username or password: the receiver URL is stored in workspace settings, where it is readable by workspace admins".to_string(),
+            "must not embed a username or password: the URL is readable by users who are not instance admins".to_string(),
         );
     }
     if !matches!(url.scheme(), "http" | "https") {
@@ -366,13 +382,21 @@ pub fn validate_webhook_base_url(value: &str) -> Result<(), String> {
     }
     if url.query().is_some() || url.fragment().is_some() {
         return Err(
-            "must not include a query string or fragment, since the webhook path is appended to it"
+            "must not include a query string or fragment, since a path is appended to it"
                 .to_string(),
         );
     }
     if value.chars().any(char::is_whitespace) {
         return Err("must not contain whitespace".to_string());
     }
+    // The UI pastes the URL into shell commands users copy, where double quotes
+    // do not stop `$(...)` or backticks from running.
+    if value.contains(SHELL_ACTIVE_CHARS) {
+        return Err(
+            "must not contain shell metacharacters, since it is shown inside commands users copy"
+                .to_string(),
+        );
+    }
     // Matches the sibling `base_url` / `hub_base_url` convention. The receiver
     // builder trims it anyway, so this is about keeping the stored value canonical
     // rather than about reachability.
@@ -1101,6 +1125,9 @@ mod tests {
             "https://hooks.example.com#",
             "https://user:password@hooks.example.com",
             "https://user@hooks.example.com",
+            "https://hooks.example.com/$(uname)",
+            "https://hooks.example.com/`uname`",
+            "https://hooks.example.com/a;b",
         ];
         for v in accept {
             assert!(
diff --git a/backend/windmill-common/src/instance_config.rs b/backend/windmill-common/src/instance_config.rs
index 700ba71df5..bd7c28628c 100644
--- a/backend/windmill-common/src/instance_config.rs
+++ b/backend/windmill-common/src/instance_config.rs
@@ -281,6 +281,8 @@ pub struct GlobalSettings {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub github_app_webhook_base_url: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub api_base_url: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub email_domain: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub hub_base_url: Option<String>,
@@ -1375,8 +1377,8 @@ pub fn diff_worker_configs(
 }
 
 /// Declaratively replace the global settings, rejecting a
-/// `github_app_webhook_base_url` or `http_route_default_allowed_origins` the
-/// API would reject.
+/// `github_app_webhook_base_url`, `api_base_url` or
+/// `http_route_default_allowed_origins` the API would reject.
 ///
 /// Every declarative writer (the `sync-config` CLI, the Kubernetes operator's
 /// ConfigMap sync) MUST go through this rather than calling
@@ -1399,29 +1401,35 @@ pub async fn sync_global_settings_declarative(
     current: &BTreeMap<String, serde_json::Value>,
     desired: &BTreeMap<String, serde_json::Value>,
 ) -> anyhow::Result<()> {
-    let webhook_key = crate::global_settings::GITHUB_APP_WEBHOOK_BASE_URL_SETTING;
-    // Non-string shapes are rejected rather than ignored: `as_str()` alone would let a
-    // bool/number/object through as if the key were absent, and the diff below would
-    // then persist it — where the HTTP path answers "must be a URL string".
-    match desired.get(webhook_key) {
-        None | Some(serde_json::Value::Null) => {}
-        Some(serde_json::Value::String(s)) if s.trim().is_empty() => {}
-        Some(serde_json::Value::String(s)) => crate::global_settings::validate_webhook_base_url(s)
-            .map_err(|e| anyhow::anyhow!("{webhook_key}: {e}"))?,
-        // Names the JSON kind rather than printing it: this is the last message on
-        // this path that could report submitted content, and an object or array could
-        // carry a secret into `sync-config` output and operator logs.
-        Some(other) => {
-            let kind = match other {
-                serde_json::Value::Bool(_) => "a boolean",
-                serde_json::Value::Number(_) => "a number",
-                serde_json::Value::Array(_) => "an array",
-                serde_json::Value::Object(_) => "an object",
-                _ => "a non-string value",
-            };
-            return Err(anyhow::anyhow!(
-                "{webhook_key} must be a URL string, got {kind}"
-            ));
+    for url_key in [
+        crate::global_settings::GITHUB_APP_WEBHOOK_BASE_URL_SETTING,
+        crate::global_settings::API_BASE_URL_SETTING,
+    ] {
+        // Non-string shapes are rejected rather than ignored: `as_str()` alone would let a
+        // bool/number/object through as if the key were absent, and the diff below would
+        // then persist it — where the HTTP path answers "must be a URL string".
+        match desired.get(url_key) {
+            None | Some(serde_json::Value::Null) => {}
+            Some(serde_json::Value::String(s)) if s.trim().is_empty() => {}
+            Some(serde_json::Value::String(s)) => {
+                crate::global_settings::validate_webhook_base_url(s)
+                    .map_err(|e| anyhow::anyhow!("{url_key}: {e}"))?
+            }
+            // Names the JSON kind rather than printing it: this is the last message on
+            // this path that could report submitted content, and an object or array could
+            // carry a secret into `sync-config` output and operator logs.
+            Some(other) => {
+                let kind = match other {
+                    serde_json::Value::Bool(_) => "a boolean",
+                    serde_json::Value::Number(_) => "a number",
+                    serde_json::Value::Array(_) => "an array",
+                    serde_json::Value::Object(_) => "an object",
+                    _ => "a non-string value",
+                };
+                return Err(anyhow::anyhow!(
+                    "{url_key} must be a URL string, got {kind}"
+                ));
+            }
         }
     }
 
diff --git a/backend/windmill-common/src/otel_oss.rs b/backend/windmill-common/src/otel_oss.rs
index bd0a5202df..95e635dd8f 100644
--- a/backend/windmill-common/src/otel_oss.rs
+++ b/backend/windmill-common/src/otel_oss.rs
@@ -132,3 +132,36 @@ pub fn otel_set_health_status_phase(_phase: &str) {}
 
 #[cfg(not(feature = "private"))]
 pub fn otel_set_health_db_unresponsive(_unresponsive: bool) {}
+
+#[cfg(not(feature = "private"))]
+pub fn otel_set_worker_memory(
+    _worker: &str,
+    _worker_group: &str,
+    _usage: Option<i64>,
+    _windmill_usage: Option<i64>,
+    _limit: Option<i64>,
+) {
+}
+
+#[cfg(not(feature = "private"))]
+pub fn otel_add_worker_cpu(
+    _worker: &str,
+    _worker_group: &str,
+    _usage_secs: f64,
+    _periods: u64,
+    _throttled_periods: u64,
+    _throttled_secs: f64,
+) {
+}
+
+#[cfg(not(feature = "private"))]
+pub fn otel_set_worker_occupancy_rate(
+    _worker: &str,
+    _worker_group: &str,
+    _window: &'static str,
+    _rate: f64,
+) {
+}
+
+#[cfg(not(feature = "private"))]
+pub fn otel_record_job_memory_peak(_tag: &str, _bytes: u64) {}
diff --git a/backend/windmill-common/src/variables.rs b/backend/windmill-common/src/variables.rs
index 1feb4182ab..b3774cdda4 100644
--- a/backend/windmill-common/src/variables.rs
+++ b/backend/windmill-common/src/variables.rs
@@ -14,7 +14,7 @@ use crate::utils::WarnAfterExt;
 use crate::worker::Connection;
 use crate::{worker::WORKER_GROUP, BASE_URL, DB};
 use chrono::{SecondsFormat, Utc};
-use magic_crypt::{MagicCrypt256, MagicCryptError, MagicCryptTrait};
+use magic_crypt::{MagicCrypt256, MagicCryptTrait};
 use quick_cache::sync::Cache;
 use serde::{Deserialize, Serialize};
 
@@ -375,13 +375,15 @@ pub fn encrypt(mc: &MagicCrypt256, value: &str) -> String {
     mc.encrypt_str_to_base64(value)
 }
 
+const DECRYPT_FAILED: &str =
+    "Could not decrypt value. The value may have been encrypted with a different key.";
+
+/// Every failure returns the same message so responses carry no signal about why decryption
+/// failed (padding, base64, UTF-8); the cause is only logged.
 pub fn decrypt(mc: &MagicCrypt256, value: String) -> error::Result<String> {
-    mc.decrypt_base64_to_string(value).map_err(|e| match e {
-        MagicCryptError::DecryptError(_) => error::Error::internal_err(
-            "Could not decrypt value. The value may have been encrypted with a different key."
-                .to_string(),
-        ),
-        _ => error::Error::internal_err(e.to_string()),
+    mc.decrypt_base64_to_string(value).map_err(|e| {
+        tracing::warn!("decryption failed: {e}");
+        error::Error::internal_err(DECRYPT_FAILED.to_string())
     })
 }
 
@@ -746,7 +748,31 @@ pub async fn get_variable_or_self_as<T: Authable + Sync>(
 
 #[cfg(test)]
 mod tests {
-    use super::{can_bind_as_prologue_const, escape_js_single_quoted, is_valid_js_identifier};
+    use super::{
+        can_bind_as_prologue_const, decrypt, escape_js_single_quoted, is_valid_js_identifier,
+        DECRYPT_FAILED,
+    };
+    use crate::error::Error;
+    use magic_crypt::MagicCryptTrait;
+
+    #[test]
+    fn decrypt_failures_all_return_the_same_message() {
+        let mc = magic_crypt::new_magic_crypt!("workspace-key", 256);
+        let other = magic_crypt::new_magic_crypt!("another-key", 256);
+        let failures = [
+            "not base64 at all!".to_string(),
+            mc.encrypt_bytes_to_base64(&[0xff, 0xfe, 0xfd]),
+            other.encrypt_str_to_base64("secret"),
+        ];
+        for value in failures {
+            match decrypt(&mc, value.clone()) {
+                Err(Error::InternalErrLoc { message, .. }) => {
+                    assert_eq!(message, DECRYPT_FAILED, "for {value:?}")
+                }
+                other => panic!("expected the uniform decrypt error for {value:?}, got {other:?}"),
+            }
+        }
+    }
 
     #[test]
     fn is_valid_js_identifier_gates_prologue_injection() {
diff --git a/backend/windmill-common/src/worker.rs b/backend/windmill-common/src/worker.rs
index e185d1d445..017c244670 100644
--- a/backend/windmill-common/src/worker.rs
+++ b/backend/windmill-common/src/worker.rs
@@ -1783,6 +1783,73 @@ pub fn get_cpu_period() -> Option<i64> {
     Some(100000)
 }
 
+/// Bucket bounds in bytes, 16 MiB to 32 GiB, shared by the Prometheus and OTel job
+/// peak-memory histograms so the two exports stay comparable.
+pub const JOB_MEMORY_PEAK_BUCKETS: [f64; 12] = {
+    let mut buckets = [0.0; 12];
+    let mut i = 0;
+    while i < 12 {
+        buckets[i] = (16u64 << (20 + i)) as f64;
+        i += 1;
+    }
+    buckets
+};
+
+/// Cumulative CPU accounting of the worker's cgroup. The throttling fields stay at 0
+/// when the cgroup has no CPU controller, which is also what an unthrottled one reports.
+#[derive(Debug, Clone, Copy, Default, PartialEq)]
+pub struct CpuStat {
+    pub usage_usec: u64,
+    pub nr_periods: u64,
+    pub nr_throttled: u64,
+    pub throttled_usec: u64,
+}
+
+fn cpu_stat_field(stat: &str, key: &str) -> Option<u64> {
+    stat.lines().find_map(|line| {
+        let (k, v) = line.split_once(' ')?;
+        (k == key).then(|| v.trim().parse().ok()).flatten()
+    })
+}
+
+fn parse_cgroup_v2_cpu_stat(stat: &str) -> Option<CpuStat> {
+    Some(CpuStat {
+        usage_usec: cpu_stat_field(stat, "usage_usec")?,
+        nr_periods: cpu_stat_field(stat, "nr_periods").unwrap_or(0),
+        nr_throttled: cpu_stat_field(stat, "nr_throttled").unwrap_or(0),
+        throttled_usec: cpu_stat_field(stat, "throttled_usec").unwrap_or(0),
+    })
+}
+
+/// cgroup v1 splits the same figures over two controllers and counts time in nanoseconds.
+fn parse_cgroup_v1_cpu_stat(cpuacct_usage: &str, stat: &str) -> Option<CpuStat> {
+    Some(CpuStat {
+        usage_usec: cpuacct_usage.trim().parse::<u64>().ok()? / 1000,
+        nr_periods: cpu_stat_field(stat, "nr_periods").unwrap_or(0),
+        nr_throttled: cpu_stat_field(stat, "nr_throttled").unwrap_or(0),
+        throttled_usec: cpu_stat_field(stat, "throttled_time").unwrap_or(0) / 1000,
+    })
+}
+
+#[cfg(not(windows))]
+pub fn get_cpu_stat() -> Option<CpuStat> {
+    const V1_USAGE: &str = "/sys/fs/cgroup/cpuacct/cpuacct.usage";
+    if Path::new(V1_USAGE).exists() {
+        parse_cgroup_v1_cpu_stat(
+            &std::fs::read_to_string(V1_USAGE).ok()?,
+            &std::fs::read_to_string("/sys/fs/cgroup/cpu/cpu.stat").unwrap_or_default(),
+        )
+    } else {
+        let cgroup_path = get_cgroupv2_path()?;
+        parse_cgroup_v2_cpu_stat(&std::fs::read_to_string(format!("{cgroup_path}/cpu.stat")).ok()?)
+    }
+}
+
+#[cfg(windows)]
+pub fn get_cpu_stat() -> Option<CpuStat> {
+    None
+}
+
 /// CPUs the process is allowed to run on, ignoring any bandwidth quota — the count
 /// Go's `NumCPU` reports. `available_parallelism` cannot stand in for it: that folds
 /// the quota in, so a fraction of a CPU makes it report a single-core machine.
@@ -1952,6 +2019,7 @@ pub enum PingType {
     MainLoop,
     Job,
     InitScript,
+    Draining,
 }
 #[derive(Serialize, Deserialize)]
 pub struct Ping {
@@ -1974,6 +2042,8 @@ pub struct Ping {
     pub occupancy_rate_30m: Option<f32>,
     pub job_isolation: Option<String>,
     pub native_mode: Option<bool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub draining: Option<bool>,
     pub ping_type: PingType,
 }
 pub async fn update_ping_http(
@@ -2026,6 +2096,7 @@ pub async fn update_ping_http(
                 insert_ping.memory,
                 insert_ping.job_isolation,
                 insert_ping.native_mode.unwrap_or(false),
+                insert_ping.draining,
                 db,
             )
             .await?;
@@ -2054,10 +2125,21 @@ pub async fn update_ping_http(
             )
             .await?
         }
+        PingType::Draining => set_worker_draining_query(worker_name, db).await?,
     }
     Ok(())
 }
 
+pub async fn set_worker_draining_query(worker_name: &str, db: &DB) -> anyhow::Result<()> {
+    sqlx::query!(
+        "UPDATE worker_ping SET draining = true WHERE worker = $1",
+        worker_name
+    )
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct JobCancelled {
     pub canceled_by: String,
@@ -2156,6 +2238,9 @@ pub async fn fetch_raw_script_from_app_query(
 /// `started_at` and `jobs_executed` are the only two columns carried over, being the
 /// continuity itself — plus `ip` for as long as `ip` is `None`, which means the external IP
 /// lookup has not resolved yet and the predecessor's address is still the best guess.
+///
+/// `draining` is `Some(false)` from a worker starting up and `None` from one re-registering
+/// mid-life, which must leave alone a flag its own shutdown may have set in the meantime.
 pub async fn insert_ping_query(
     worker_instance: &str,
     worker_name: &str,
@@ -2169,6 +2254,7 @@ pub async fn insert_ping_query(
     memory: Option<i64>,
     job_isolation: Option<String>,
     native_mode: bool,
+    draining: Option<bool>,
     db: &DB,
 ) -> anyhow::Result<i32> {
     // A NULL `ip` means the external IP lookup is still in flight; a later ping fills it in, and
@@ -2176,8 +2262,8 @@ pub async fn insert_ping_query(
     // lookup that has failed reports `external_ip::UNRETRIEVABLE_IP`, which does overwrite it. The
     // literal below must stay equal to `external_ip::UNKNOWN_IP`.
     let previous_jobs_executed = sqlx::query_scalar!(
-        "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, dedicated_workers, wm_version, vcpus, memory, job_isolation, native_mode) VALUES ($1, $2, COALESCE($3, 'NO IP'), $4, $5, $6, $7, $8, $9, $10, $11, $12) ON CONFLICT (worker)
-        DO UPDATE set ping_at = now(), worker_instance = EXCLUDED.worker_instance, ip = COALESCE($3, worker_ping.ip), custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group, dedicated_worker = EXCLUDED.dedicated_worker, dedicated_workers = EXCLUDED.dedicated_workers, wm_version = EXCLUDED.wm_version, vcpus = COALESCE(EXCLUDED.vcpus, worker_ping.vcpus), memory = COALESCE(EXCLUDED.memory, worker_ping.memory), job_isolation = EXCLUDED.job_isolation, native_mode = EXCLUDED.native_mode, current_job_id = NULL, current_job_workspace_id = NULL
+        "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, dedicated_workers, wm_version, vcpus, memory, job_isolation, native_mode, draining) VALUES ($1, $2, COALESCE($3, 'NO IP'), $4, $5, $6, $7, $8, $9, $10, $11, $12, COALESCE($13, false)) ON CONFLICT (worker)
+        DO UPDATE set ping_at = now(), worker_instance = EXCLUDED.worker_instance, ip = COALESCE($3, worker_ping.ip), custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group, dedicated_worker = EXCLUDED.dedicated_worker, dedicated_workers = EXCLUDED.dedicated_workers, wm_version = EXCLUDED.wm_version, vcpus = COALESCE(EXCLUDED.vcpus, worker_ping.vcpus), memory = COALESCE(EXCLUDED.memory, worker_ping.memory), job_isolation = EXCLUDED.job_isolation, native_mode = EXCLUDED.native_mode, current_job_id = NULL, current_job_workspace_id = NULL, draining = COALESCE($13, worker_ping.draining)
         RETURNING jobs_executed",
         worker_instance,
         worker_name,
@@ -2191,6 +2277,7 @@ pub async fn insert_ping_query(
         memory,
         job_isolation.as_deref(),
         native_mode,
+        draining,
         )
         .fetch_one(db)
         .await?;
@@ -2899,6 +2986,32 @@ mod tests {
     use super::*;
     use std::collections::HashMap;
 
+    #[test]
+    fn cgroup_cpu_stat_is_normalized_to_microseconds() {
+        let v2 = "usage_usec 2500000\nuser_usec 2000000\nsystem_usec 500000\n\
+                  nr_periods 40\nnr_throttled 7\nthrottled_usec 350000\nnr_bursts 0\n";
+        let expected = CpuStat {
+            usage_usec: 2_500_000,
+            nr_periods: 40,
+            nr_throttled: 7,
+            throttled_usec: 350_000,
+        };
+        assert_eq!(parse_cgroup_v2_cpu_stat(v2), Some(expected));
+
+        let v1_stat = "nr_periods 40\nnr_throttled 7\nthrottled_time 350000000\n";
+        assert_eq!(
+            parse_cgroup_v1_cpu_stat("2500000000\n", v1_stat),
+            Some(expected)
+        );
+
+        // No CPU controller: usage is still reported, throttling reads as zero.
+        assert_eq!(
+            parse_cgroup_v2_cpu_stat("usage_usec 12\nuser_usec 8\nsystem_usec 4\n"),
+            Some(CpuStat { usage_usec: 12, ..Default::default() })
+        );
+        assert_eq!(parse_cgroup_v2_cpu_stat("nr_periods 40\n"), None);
+    }
+
     #[test]
     fn datatable_role_is_read_from_the_leading_comment_block() {
         let role = |code| SqlAnnotations::datatable_role(code);
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index 207c8ee176..389ae1d112 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -359,6 +359,22 @@ ORDER BY depth, id
     .filter_map(|r| r.id.clone())
     .collect_vec();
 
+    // A native retry is the child of its first attempt, which has completed by the time the
+    // retry is queued, so the walk above stops before reaching it.
+    let tree = [&[job.id][..], &jobs_to_cancel[..]].concat();
+    let pending_retries = sqlx::query_scalar!(
+        "SELECT q.id FROM v2_job_queue q
+            JOIN native_retry_attempt n ON n.job_id = q.id
+            JOIN v2_job r ON r.id = q.id
+            JOIN v2_job a ON a.id = r.parent_job
+            WHERE q.workspace_id = $2 AND a.parent_job = ANY($1)",
+        tree.as_slice(),
+        w_id
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+    jobs_to_cancel.extend(pending_retries);
+
     jobs_to_cancel.reverse();
     if !jobs_to_cancel.is_empty() {
         tracing::info!("Found {} child jobs to cancel", jobs_to_cancel.len());
@@ -1205,7 +1221,7 @@ pub async fn add_completed_job_pre_shaped_failure<T: Serialize + Send + Sync + V
     worker_name: &str,
     flow_is_done: bool,
     duration: Option<i64>,
-) -> Result<(), Error> {
+) -> Result<CompletedSpan, Error> {
     record_failure_metrics(completed_job, worker_name).await;
 
     tracing::error!(
@@ -1213,7 +1229,7 @@ pub async fn add_completed_job_pre_shaped_failure<T: Serialize + Send + Sync + V
         completed_job.id,
         completed_job.workspace_id,
     );
-    let _ = add_completed_job(
+    let (_, span) = add_completed_job(
         db,
         completed_job,
         false,
@@ -1228,7 +1244,7 @@ pub async fn add_completed_job_pre_shaped_failure<T: Serialize + Send + Sync + V
     )
     .warn_after_seconds(10)
     .await?;
-    Ok(())
+    Ok(span)
 }
 
 pub async fn add_completed_job_error(
@@ -1241,6 +1257,31 @@ pub async fn add_completed_job_error(
     flow_is_done: bool,
     duration: Option<i64>,
 ) -> Result<WrappedError, Error> {
+    add_completed_job_error_with_span(
+        db,
+        completed_job,
+        mem_peak,
+        canceled_by,
+        e,
+        worker_name,
+        flow_is_done,
+        duration,
+    )
+    .await
+    .map(|(wrapped, _)| wrapped)
+}
+
+/// `add_completed_job_error`, also handing back what the completed row holds.
+pub async fn add_completed_job_error_with_span(
+    db: &Pool<Postgres>,
+    completed_job: &MiniCompletedJob,
+    mem_peak: i32,
+    canceled_by: Option<CanceledBy>,
+    e: serde_json::Value,
+    worker_name: &str,
+    flow_is_done: bool,
+    duration: Option<i64>,
+) -> Result<(WrappedError, CompletedSpan), Error> {
     record_failure_metrics(completed_job, worker_name).await;
 
     let result = WrappedError { error: e };
@@ -1250,7 +1291,7 @@ pub async fn add_completed_job_error(
         completed_job.workspace_id,
         serde_json::to_string(&result).unwrap_or_else(|_| "".to_string())
     );
-    let _ = add_completed_job(
+    let (_, span) = add_completed_job(
         db,
         &completed_job,
         false,
@@ -1265,7 +1306,7 @@ pub async fn add_completed_job_error(
     )
     .warn_after_seconds(10)
     .await?;
-    Ok(result)
+    Ok((result, span))
 }
 
 lazy_static::lazy_static! {
@@ -1304,7 +1345,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     flow_is_done: bool,
     duration: Option<i64>,
     from_cache: bool,
-) -> Result<(Uuid, i64), Error> {
+) -> Result<(Uuid, CompletedSpan), Error> {
     // tracing::error!("Start");
     // let start = tokio::time::Instant::now();
 
@@ -1338,7 +1379,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     };
 
     let result_columns = result_columns.as_ref();
-    let (opt_uuid, duration, _skip_downstream_error_handlers, wac_parent_ready) = (|| {
+    let (opt_uuid, span, _skip_downstream_error_handlers, wac_parent_ready) = (|| {
         commit_completed_job(
             db,
             completed_job,
@@ -1379,7 +1420,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
 
     // if scheduling next job failed, return the job_id early to ensure the job get retried after a timeout
     if let Some(job_id) = opt_uuid {
-        return Ok((job_id, duration));
+        return Ok((job_id, span));
     }
 
     // Auto-resolve a retry chain that ultimately worked, from whichever of the two
@@ -1391,7 +1432,18 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
             .then(|| completed_job.parent_job)
             .flatten()
     } else if !success && !skipped && retry_pending {
-        Some(completed_job.parent_job.unwrap_or(completed_job.id))
+        let is_retry_attempt = sqlx::query_scalar!(
+            "SELECT attempt FROM native_retry_attempt WHERE job_id = $1",
+            completed_job.id,
+        )
+        .fetch_optional(db)
+        .await
+        .unwrap_or_else(|e| {
+            tracing::error!("reading the retry marker of {}: {e:#}", completed_job.id);
+            None
+        })
+        .is_some();
+        Some(native_retry_root(completed_job, is_retry_attempt))
     } else {
         None
     };
@@ -1409,7 +1461,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     }
 
     #[cfg(feature = "cloud")]
-    apply_completed_job_cloud_usage(db, completed_job, duration);
+    apply_completed_job_cloud_usage(db, completed_job, span.last_run_ms);
 
     #[cfg(all(feature = "enterprise", feature = "private"))]
     crate::jobs_ee::apply_completed_job_error_handlers(
@@ -1426,7 +1478,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
 
     // tracing::error!("4 {:?}", start.elapsed());
 
-    Ok((completed_job.id, duration))
+    Ok((completed_job.id, span))
 }
 
 async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
@@ -1444,7 +1496,7 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     // True when a native script retry was enqueued for this failed attempt, i.e.
     // this is not the terminal attempt — schedule completion handlers must wait.
     retry_pending: bool,
-) -> windmill_common::error::Result<(Option<Uuid>, i64, bool, bool)> {
+) -> windmill_common::error::Result<(Option<Uuid>, CompletedSpan, bool, bool)> {
     // let start = std::time::Instant::now();
 
     let job_id = completed_job.id;
@@ -1511,11 +1563,11 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
         && monitor_parent.is_none()
         && !is_scheduled
     {
-        let Some(duration) = completion.execute(&mut *db.acquire().await?).await? else {
+        let Some(completed) = completion.execute(&mut *db.acquire().await?).await? else {
             return Err(not_in_queue_error(db, job_id).await);
         };
-        log_completed_job(completed_job, duration, success);
-        return Ok((None, duration, false, false));
+        log_completed_job(completed_job, completed.duration_ms, success);
+        return Ok((None, completed, false, false));
     }
 
     let mut tx = db.begin().warn_after_seconds(10).await?;
@@ -1523,7 +1575,8 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     // The parent's rows are locked ahead of the child's own queue row (see
     // `record_child_completion` for the order this must keep), so the duration it stamps is read
     // before the completion: the one the completed row will hold. `now()` is fixed for the
-    // transaction, and a completed row already there keeps its own duration.
+    // transaction, and a completed row already there keeps its own duration. For a child that
+    // itself parked it is the last run's, matching the last start its timeline entry carries.
     let mut wac_parent_ready = false;
     if let Some(parent_job) = wac_parent {
         let Some(duration) = sqlx::query_scalar!(
@@ -1550,7 +1603,7 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
         .await?;
     }
 
-    let Some(duration) = completion.execute(&mut *tx).await? else {
+    let Some(completed) = completion.execute(&mut *tx).await? else {
         return Err(not_in_queue_error(&mut *tx, job_id).await);
     };
 
@@ -1760,16 +1813,35 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
 
     tx.commit().warn_after_seconds(10).await?;
 
-    log_completed_job(completed_job, duration, success);
+    log_completed_job(completed_job, completed.duration_ms, success);
     // tracing::info!("completed job: {:?}", start.elapsed().as_micros());
     Ok((
         None,
-        duration,
+        completed,
         _skip_downstream_error_handlers,
         wac_parent_ready,
     ))
 }
 
+/// What a job's completion wrote. `started_at` and `duration_ms` are the completed row's.
+/// `last_run_ms` is the time the job's last run held a worker, which is what gets metered;
+/// it differs from `duration_ms` only for a job that parked.
+#[derive(Debug, Clone, Copy)]
+pub struct CompletedSpan {
+    pub started_at: Option<chrono::DateTime<chrono::Utc>>,
+    pub duration_ms: i64,
+    pub last_run_ms: i64,
+}
+
+impl CompletedSpan {
+    /// Whether the row spans more than the run that started at `last_started_at`, i.e. the
+    /// job parked and resumed. A flow records such a step with the row's span, so the step
+    /// reads like the job does.
+    pub fn outlasts_run(&self, last_started_at: Option<chrono::DateTime<chrono::Utc>>) -> bool {
+        matches!((self.started_at, last_started_at), (Some(first), Some(last)) if first < last)
+    }
+}
+
 /// What a job's completion writes, for `Completion::execute`.
 struct Completion<'a> {
     completed_job: &'a MiniCompletedJob,
@@ -1786,6 +1858,11 @@ impl Completion<'_> {
     /// Moves the job from the queue to the completed jobs and refreshes a flow step's parent
     /// ping, as one statement. Returns `None` when the job was no longer in the queue.
     ///
+    /// For a job that parked (a Workflow-as-Code parent, see `suspend_wac_parent`) the row's
+    /// `started_at` and `duration_ms` span the whole workflow from its first start, and the
+    /// last run goes to `extras.wac_last_segment_ms` for readers that sum worker time from
+    /// completed rows.
+    ///
     /// The completion takes its cancellation from the queue row it deletes, not only from
     /// `canceled_by`: that is what the worker last read, and the delete waits for a cancel still
     /// being written, so the deleted row is the final word on whether the job was canceled.
@@ -1793,7 +1870,7 @@ impl Completion<'_> {
     /// It locks the queue row before the completed row's key. Any other writer completing a job
     /// (the monitor's zombie fallback, debounce) must take them in the same order, or the two
     /// deadlock.
-    async fn execute(&self, conn: &mut sqlx::PgConnection) -> error::Result<Option<i64>> {
+    async fn execute(&self, conn: &mut sqlx::PgConnection) -> error::Result<Option<CompletedSpan>> {
         let Completion {
             completed_job,
             success,
@@ -1824,16 +1901,20 @@ impl Completion<'_> {
             .then_some(completed_job.parent_job)
             .flatten()
         else {
-            return sqlx::query_scalar!(
+            return sqlx::query_as!(
+                CompletedSpan,
                 "WITH deleted AS (
                     DELETE FROM v2_job_queue WHERE id = $1
-                    RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason
+                    RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason,
+                        (extras->>'wac_first_started_at')::timestamptz AS first_started_at,
+                        COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000)::bigint AS run_ms
                 ), completed AS (
                     INSERT INTO v2_job_completed AS cj
                         ( workspace_id
                         , id
                         , started_at
                         , duration_ms
+                        , extras
                         , result
                         , result_columns
                         , canceled_by
@@ -1844,8 +1925,11 @@ impl Completion<'_> {
                         , status
                         , worker
                         )
-                    SELECT d.workspace_id, d.id, d.started_at,
-                        COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(d.started_at, now()))))*1000),
+                    SELECT d.workspace_id, d.id, COALESCE(d.first_started_at, d.started_at),
+                        CASE WHEN d.first_started_at IS NULL THEN d.run_ms
+                            ELSE EXTRACT('epoch' FROM (now() - d.first_started_at))*1000 END,
+                        CASE WHEN d.first_started_at IS NOT NULL
+                            THEN jsonb_build_object('wac_last_segment_ms', d.run_ms) END,
                         $3::text::jsonb, $10,
                         CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,
                         CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,
@@ -1861,9 +1945,11 @@ impl Completion<'_> {
                             THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,
                         canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL
                             THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END
-                    RETURNING duration_ms
+                    RETURNING cj.started_at, cj.duration_ms,
+                        COALESCE((cj.extras->>'wac_last_segment_ms')::bigint, cj.duration_ms) AS last_run_ms
                 )
-                SELECT duration_ms AS \"duration_ms!\" FROM completed",
+                SELECT started_at AS \"started_at?\", duration_ms AS \"duration_ms!\",
+                    last_run_ms AS \"last_run_ms!\" FROM completed",
                 /* $1 */ completed_job.id,
                 /* $2 */ success,
                 /* $3 */ result,
@@ -1883,16 +1969,20 @@ impl Completion<'_> {
         // A canceled flow is pinged too: it is completed by its next transition like any other
         // flow, and the zombie flow monitor needs the ping to finish the cancel if that
         // transition is lost.
-        sqlx::query_scalar!(
+        sqlx::query_as!(
+        CompletedSpan,
         "WITH deleted AS (
             DELETE FROM v2_job_queue WHERE id = $1
-            RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason
+            RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason,
+                (extras->>'wac_first_started_at')::timestamptz AS first_started_at,
+                COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000)::bigint AS run_ms
         ), completed AS (
             INSERT INTO v2_job_completed AS cj
                 ( workspace_id
                 , id
                 , started_at
                 , duration_ms
+                , extras
                 , result
                 , result_columns
                 , canceled_by
@@ -1903,8 +1993,11 @@ impl Completion<'_> {
                 , status
                 , worker
                 )
-            SELECT d.workspace_id, d.id, d.started_at,
-                COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(d.started_at, now()))))*1000),
+            SELECT d.workspace_id, d.id, COALESCE(d.first_started_at, d.started_at),
+                CASE WHEN d.first_started_at IS NULL THEN d.run_ms
+                    ELSE EXTRACT('epoch' FROM (now() - d.first_started_at))*1000 END,
+                CASE WHEN d.first_started_at IS NOT NULL
+                    THEN jsonb_build_object('wac_last_segment_ms', d.run_ms) END,
                 $3::text::jsonb, $10,
                 CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,
                 CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,
@@ -1920,14 +2013,16 @@ impl Completion<'_> {
                     THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,
                 canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL
                     THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END
-            RETURNING duration_ms
+            RETURNING cj.started_at, cj.duration_ms,
+                COALESCE((cj.extras->>'wac_last_segment_ms')::bigint, cj.duration_ms) AS last_run_ms
         ), parent_ping AS (
             UPDATE v2_job_runtime r SET ping = now()
             FROM v2_job_queue q
             WHERE r.id = $11 AND q.id = r.id AND q.workspace_id = $12
                 AND EXISTS (SELECT 1 FROM completed)
         )
-        SELECT duration_ms AS \"duration_ms!\" FROM completed",
+        SELECT started_at AS \"started_at?\", duration_ms AS \"duration_ms!\",
+            last_run_ms AS \"last_run_ms!\" FROM completed",
         /* $1 */ completed_job.id,
         /* $2 */ success,
         /* $3 */ result,
@@ -1994,7 +2089,7 @@ async fn check_result_size<T: ValidableJson>(
     db: &Pool<Postgres>,
     queued_job: &MiniCompletedJob,
     result: Json<&T>,
-) -> Option<Result<(Option<Uuid>, i64, bool, bool), Error>> {
+) -> Option<Result<(Option<Uuid>, CompletedSpan, bool, bool), Error>> {
     let result_size = result.size() / 1024 / 1024;
     if result_size > 2 {
         if result_size > *MAX_RESULT_SIZE_MB {
@@ -2194,18 +2289,17 @@ async fn restart_job_if_perpetual_inner(
 /// resolution too; `ON CONFLICT DO NOTHING` keeps a human's note intact.
 ///
 /// Membership of the chain must be *proven* per row, never inferred from `parent_job`
-/// alone: `root` is `job.parent_job.unwrap_or(job.id)`, so for a job launched with an
-/// explicit `parent_job` (WAC inline children, SDK-launched children) `root` is the
-/// *calling* job, and its other failed children are unrelated. Resolving those would hide
-/// exactly the failures this feature exists to surface, so each row must be either
+/// alone: the success-side caller passes the succeeding job's `parent_job`, which for a
+/// job launched with an explicit parent (WAC inline children, SDK-launched children) is
+/// the *calling* job, and its other failed children are unrelated. Resolving those would
+/// hide exactly the failures this feature exists to surface, so each row must be either
 /// - a job carrying a `native_retry_attempt` marker under `root` (provably an attempt), or
-/// - `root` itself as the original attempt, which is only provable when `root` is
-///   parentless and unmarked.
+/// - `root` itself as the original attempt: unmarked, and proven a chain root by the
+///   marked success under it, since only a chain root is ever a marked job's parent
+///   (see [`native_retry_root`]).
 ///
 /// Both arms also require the same `runnable_id` as the succeeding attempt, since every
-/// attempt in a chain runs the same runnable. The deliberate cost is a miss, not an
-/// over-reach: when the original attempt had a parent it is an unmarked sibling
-/// indistinguishable from any other child of the caller, so it stays red.
+/// attempt in a chain runs the same runnable.
 ///
 /// Nothing is trusted of the caller (this writes through a privileged pool): the gate is
 /// "some marked attempt under `root` running `runnable_id` has succeeded", evaluated in
@@ -2249,7 +2343,7 @@ pub async fn resolve_retry_chain_if_succeeded(
                     AND (
                         (j.parent_job = $1
                             AND EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))
-                        OR (c.id = $1 AND j.parent_job IS NULL
+                        OR (c.id = $1
                             AND NOT EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))
                     )
             ON CONFLICT (job_id) DO NOTHING",
@@ -2303,6 +2397,18 @@ async fn eval_retry_if(
     false
 }
 
+/// The first attempt of `job`'s native retry chain, which every later attempt is pushed
+/// with as `parent_job` and whose id seeds theirs. A first attempt may have a parent of its
+/// own (a script dispatched from another job), so only a marked attempt's parent is the root:
+/// rooting at that outer parent would merge the chains of its retried children.
+fn native_retry_root(job: &MiniCompletedJob, is_retry_attempt: bool) -> Uuid {
+    if is_retry_attempt {
+        job.parent_job.unwrap_or(job.id)
+    } else {
+        job.id
+    }
+}
+
 /// Native script retry. When a failed `Script` or `Script_Hub` job carries a retry
 /// policy (via `runnable_settings_handle`) and has attempts left, enqueue a fresh
 /// attempt of the same script after the policy's backoff delay — instead of having
@@ -2346,6 +2452,18 @@ pub async fn maybe_enqueue_native_script_retry(
     if !policy.has_attempts() {
         return Ok(false);
     }
+    // Cancelling a job that has a parent (every retry attempt does) only flags its queue row,
+    // and the worker that pulls it completes it without a `canceled_by`: read the flag here.
+    let soft_canceled = sqlx::query_scalar!(
+        "SELECT canceled_by IS NOT NULL AS \"canceled!\" FROM v2_job_queue WHERE id = $1",
+        job.id,
+    )
+    .fetch_optional(db)
+    .await?
+    .unwrap_or(false);
+    if soft_canceled {
+        return Ok(false);
+    }
 
     // Attempt counter for this job: its `native_retry_attempt` marker, or 0 for
     // the first (un-marked) attempt. The marker is persistent (unlike the queue
@@ -2358,7 +2476,7 @@ pub async fn maybe_enqueue_native_script_retry(
     .fetch_optional(db)
     .await?
     .unwrap_or(0) as u32;
-    let root = job.parent_job.unwrap_or(job.id);
+    let root = native_retry_root(job, prev_attempts > 0);
     // Scheduled chains keep the schedule trigger so the terminal attempt drives
     // the schedule completion handlers (on_failure/on_success); `parent_job`
     // keeps every retry out of the per-occurrence handler counting queries.
diff --git a/backend/windmill-queue/tests/native_retry_test.rs b/backend/windmill-queue/tests/native_retry_test.rs
index 9b0e05a74c..4cf278cf83 100644
--- a/backend/windmill-queue/tests/native_retry_test.rs
+++ b/backend/windmill-queue/tests/native_retry_test.rs
@@ -561,4 +561,123 @@ mod native_retry {
                 .unwrap();
         assert_eq!(status, "failure", "resolving must not change job status");
     }
+
+    // A script dispatched from another job keeps that job as its parent, so its chain is
+    // rooted at the first attempt itself: sibling dispatches must not share retry ids, and
+    // a parented first attempt is still resolved once its retry succeeds.
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn parented_first_attempts_root_their_own_chains(
+        db: Pool<Postgres>,
+    ) -> anyhow::Result<()> {
+        let retry = Retry {
+            constant: ConstantDelay { attempts: 1, seconds: 0 },
+            exponential: Default::default(),
+            retry_if: None,
+        };
+        let handle = insert_rs(
+            RunnableSettings {
+                debouncing_settings: None,
+                concurrency_settings: None,
+                retry_settings: RetrySettings::from(&retry).insert_cached(&db).await?,
+            },
+            &db,
+        )
+        .await?;
+        let dispatcher = Uuid::new_v4();
+        let (a, b) = (Uuid::new_v4(), Uuid::new_v4());
+        for first in [a, b] {
+            let attempt = mini(first, Some(dispatcher), handle);
+            assert!(maybe_enqueue_native_script_retry(&db, &attempt, &None, &no_result).await?);
+        }
+        assert!(
+            retry_by_attempt(&db, a, 1).await.is_some(),
+            "a's retry hangs off a"
+        );
+        assert!(
+            retry_by_attempt(&db, b, 1).await.is_some(),
+            "b's retry is not mistaken for a's"
+        );
+
+        let (c, c_retry, c_sibling) = (Uuid::new_v4(), Uuid::new_v4(), Uuid::new_v4());
+        seed_job(&db, c, Some(dispatcher), false, "failure").await;
+        seed_job(&db, c_sibling, Some(dispatcher), false, "failure").await;
+        seed_job(&db, c_retry, Some(c), true, "success").await;
+        windmill_queue::jobs::resolve_retry_chain_if_succeeded(&db, c, WS, None).await?;
+        windmill_queue::jobs::resolve_retry_chain_if_succeeded(&db, dispatcher, WS, None).await?;
+        let resolved: Vec<Uuid> = sqlx::query_scalar("SELECT job_id FROM job_resolution")
+            .fetch_all(&db)
+            .await?;
+        assert_eq!(
+            resolved,
+            vec![c],
+            "only the parented first attempt resolves, not its sibling"
+        );
+        Ok(())
+    }
+
+    // Cancelling the job that dispatched a script reaches that script's pending retry, which
+    // hangs off a first attempt that has already completed.
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn cancelling_the_caller_cancels_a_pending_retry(
+        db: Pool<Postgres>,
+    ) -> anyhow::Result<()> {
+        let retry = Retry {
+            constant: ConstantDelay { attempts: 2, seconds: 60 },
+            exponential: Default::default(),
+            retry_if: None,
+        };
+        let handle = insert_rs(
+            RunnableSettings {
+                debouncing_settings: None,
+                concurrency_settings: None,
+                retry_settings: RetrySettings::from(&retry).insert_cached(&db).await?,
+            },
+            &db,
+        )
+        .await?;
+        let (caller, first) = (Uuid::new_v4(), Uuid::new_v4());
+        sqlx::query(
+            "INSERT INTO v2_job (id, workspace_id, kind, runnable_path) VALUES ($1, $2, 'script', $3)",
+        )
+        .bind(caller)
+        .bind(WS)
+        .bind(SCRIPT)
+        .execute(&db)
+        .await?;
+        sqlx::query(
+            "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, running) VALUES ($1, $2, now(), true)",
+        )
+        .bind(caller)
+        .bind(WS)
+        .execute(&db)
+        .await?;
+        seed_job(&db, first, Some(caller), false, "failure").await;
+        let attempt = mini(first, Some(caller), handle);
+        assert!(maybe_enqueue_native_script_retry(&db, &attempt, &None, &no_result).await?);
+        let (retry_id, ..) = retry_by_attempt(&db, first, 1)
+            .await
+            .expect("retry is queued");
+
+        let tx = db.begin().await?;
+        let (tx, _) =
+            windmill_queue::jobs::cancel_job("test-user", None, caller, WS, tx, &db, false, false)
+                .await?;
+        tx.commit().await?;
+
+        let canceled_by: Option<String> =
+            sqlx::query_scalar("SELECT canceled_by FROM v2_job_queue WHERE id = $1")
+                .bind(retry_id)
+                .fetch_one(&db)
+                .await?;
+        assert_eq!(canceled_by.as_deref(), Some("test-user"));
+
+        // The worker that pulls the canceled retry completes it without a `canceled_by`.
+        let (_, _, _, _, retry_handle) = retry_by_attempt(&db, first, 1).await.unwrap();
+        let canceled_retry = mini(retry_id, Some(first), retry_handle);
+        assert!(
+            !maybe_enqueue_native_script_retry(&db, &canceled_retry, &None, &no_result).await?,
+            "a canceled retry does not enqueue the next attempt"
+        );
+        Ok(())
+    }
 }
diff --git a/backend/windmill-worker-volumes/src/lib.rs b/backend/windmill-worker-volumes/src/lib.rs
index e2e4ab866b..364795510a 100644
--- a/backend/windmill-worker-volumes/src/lib.rs
+++ b/backend/windmill-worker-volumes/src/lib.rs
@@ -54,11 +54,45 @@ pub struct VolumeMount {
     pub target: String,
 }
 
+/// A file's size and last change time. Sync-back trusts a pulled file's stored hash only while
+/// its stamp is the one taken at hand-off: size alone misses a rewrite of the same length. A
+/// write within the filesystem's timestamp granularity of the hand-off is not seen.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FileStamp {
+    size: u64,
+    changed: Option<(i64, i64)>,
+}
+
+impl FileStamp {
+    /// Whether the file is as it was at `earlier`. An unreadable change time never matches.
+    pub fn unchanged_since(&self, earlier: &FileStamp) -> bool {
+        self.changed.is_some() && self == earlier
+    }
+
+    pub fn of(meta: &std::fs::Metadata) -> Self {
+        // ctime rather than mtime: a tool that restores mtime (cp -p, tar, rsync -t) cannot set it.
+        #[cfg(unix)]
+        let changed = {
+            use std::os::unix::fs::MetadataExt;
+            Some((meta.ctime(), meta.ctime_nsec()))
+        };
+        #[cfg(not(unix))]
+        let changed = meta
+            .modified()
+            .ok()
+            .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+            .map(|d| (d.as_secs() as i64, d.subsec_nanos() as i64));
+        Self { size: meta.len(), changed }
+    }
+}
+
 pub struct VolumeState {
     pub mount: VolumeMount,
     pub local_dir: PathBuf,
     pub manifest: HashMap<String, FileEntry>,
     pub symlinks: HashMap<String, String>,
+    /// Stamp of each pulled file as the job received it, keyed like `manifest`.
+    pub stamps: HashMap<String, FileStamp>,
 }
 
 pub struct DownloadStats {
diff --git a/backend/windmill-worker/src/bun_executor.rs b/backend/windmill-worker/src/bun_executor.rs
index bb47d3e4be..1ae588ef11 100644
--- a/backend/windmill-worker/src/bun_executor.rs
+++ b/backend/windmill-worker/src/bun_executor.rs
@@ -3731,7 +3731,10 @@ pub async fn handle_wac_v2_output(
             // status row, the order every child completion takes.
             let segment_ms = sqlx::query_scalar!(
                 "WITH prev AS (SELECT started_at FROM v2_job_queue WHERE id = $1)
-                 UPDATE v2_job_queue q SET running = false, started_at = null
+                 UPDATE v2_job_queue q SET running = false, started_at = null,
+                     extras = CASE WHEN q.started_at IS NULL OR q.extras ? 'wac_first_started_at' THEN q.extras
+                         ELSE jsonb_set(COALESCE(q.extras, '{}'::jsonb), '{wac_first_started_at}', to_jsonb(q.started_at))
+                     END
                  FROM prev WHERE q.id = $1
                  RETURNING (extract(epoch FROM now() - prev.started_at) * 1000)::bigint",
                 job.id,
diff --git a/backend/windmill-worker/src/common.rs b/backend/windmill-worker/src/common.rs
index 01523eba59..745f202826 100644
--- a/backend/windmill-worker/src/common.rs
+++ b/backend/windmill-worker/src/common.rs
@@ -643,6 +643,7 @@ pub async fn update_worker_ping_for_failed_init_script(
                         wm_memory_usage: None,
                         job_isolation: None,
                         native_mode: None,
+                        draining: None,
                         ping_type: PingType::InitScript,
                     },
                 )
diff --git a/backend/windmill-worker/src/handle_child.rs b/backend/windmill-worker/src/handle_child.rs
index fa06edf6bf..84fd547641 100644
--- a/backend/windmill-worker/src/handle_child.rs
+++ b/backend/windmill-worker/src/handle_child.rs
@@ -1049,6 +1049,7 @@ where
                     let wm_memory_usage = get_windmill_memory_usage();
                     tracing::info!("job {job_id} on {worker_name} in {w_id} worker memory snapshot {}kB/{}kB", memory_usage.unwrap_or_default()/1024, wm_memory_usage.unwrap_or_default()/1024);
                     let occupancy = occupancy_metrics.as_mut().map(|x| x.update_occupancy_metrics());
+                    crate::resource_metrics::record_worker_resources(worker_name, memory_usage, wm_memory_usage, occupancy.as_ref());
                     if job_id != Uuid::nil() {
                         if let Err(err) = update_worker_ping_from_job(&conn, &job_id, w_id, worker_name, memory_usage, wm_memory_usage, occupancy).await {
                             tracing::error!("Unable to update worker ping for job {} in workspace {}. Error was: {:?}", job_id, w_id, err);
@@ -1140,8 +1141,8 @@ fn child_joined_output_stream(
         .take()
         .expect("child did not have a handle to stdout");
 
-    let stdout = BufReader::new(stdout).lines();
-    let stderr = BufReader::new(stderr).lines();
+    let stdout = BufReader::new(stdout).split(b'\n');
+    let stderr = BufReader::new(stderr).split(b'\n');
     stream::select(
         lines_to_stream(stderr, true, job_id.clone(), w_id.clone())
             .map(|l| l.map(|line| OutputLine { stderr: true, line })),
@@ -1151,18 +1152,32 @@ fn child_joined_output_stream(
 }
 
 pub fn lines_to_stream<R: tokio::io::AsyncBufRead + Unpin>(
-    mut lines: tokio::io::Lines<R>,
+    mut lines: tokio::io::Split<R>,
     stderr: bool,
     job_id: Uuid,
     w_id: String,
 ) -> impl futures::Stream<Item = io::Result<String>> {
     stream::poll_fn(move |cx| {
         std::pin::Pin::new(&mut lines)
-            .poll_next_line(cx)
-            .map(|result| process_streaming_log_lines(result, stderr, &job_id, &w_id))
+            .poll_next_segment(cx)
+            .map(|result| {
+                let result = result.map(|segment| segment.map(decode_output_line));
+                process_streaming_log_lines(result, stderr, &job_id, &w_id)
+            })
     })
 }
 
+/// Child output is not guaranteed to be UTF-8 (e.g. pwsh on Windows writes in the
+/// console code page), so decode lossily: a strict decode errors out and ends log
+/// capture for the rest of the job. Strips a trailing `\r` so CRLF output doesn't keep it.
+pub(crate) fn decode_output_line(mut segment: Vec<u8>) -> String {
+    if segment.last() == Some(&b'\r') {
+        segment.pop();
+    }
+    String::from_utf8(segment)
+        .unwrap_or_else(|err| String::from_utf8_lossy(err.as_bytes()).into_owned())
+}
+
 pub fn process_status(
     program: &str,
     status: ExitStatus,
@@ -1209,4 +1224,33 @@ mod tests {
         let left = JobDeadline(Some(Instant::now() + Duration::from_secs(120)));
         assert!(matches!(left.remaining_secs(), Some(s) if (118..=120).contains(&s)));
     }
+
+    // "Prüfe" in CP850/1252 is not UTF-8. A strict decode errors on that line and
+    // would stop log capture, dropping every line after it.
+    #[tokio::test]
+    async fn a_non_utf8_line_is_decoded_lossily_and_later_lines_still_arrive() {
+        let output: &[u8] =
+            b"start\r\nPr\x81fe Benutzer\nPr\xfcfe\nGr\xc3\xbc\xc3\x9fe\r\nafter\n\nlast";
+        let lines: Vec<String> = lines_to_stream(
+            BufReader::new(output).split(b'\n'),
+            false,
+            Uuid::nil(),
+            "w".into(),
+        )
+        .map(|line| line.expect("reading from a byte slice cannot fail"))
+        .collect()
+        .await;
+        assert_eq!(
+            lines,
+            vec![
+                "start",
+                "Pr\u{FFFD}fe Benutzer",
+                "Pr\u{FFFD}fe",
+                "Grüße",
+                "after",
+                "",
+                "last",
+            ]
+        );
+    }
 }
diff --git a/backend/windmill-worker/src/lib.rs b/backend/windmill-worker/src/lib.rs
index 6059936af6..aa1d9ab209 100644
--- a/backend/windmill-worker/src/lib.rs
+++ b/backend/windmill-worker/src/lib.rs
@@ -81,6 +81,7 @@ mod prepare_deps;
 mod python_executor;
 #[cfg(feature = "python")]
 mod python_versions;
+mod resource_metrics;
 pub mod result_processor;
 #[cfg(feature = "rust")]
 mod rust_executor;
diff --git a/backend/windmill-worker/src/resource_metrics.rs b/backend/windmill-worker/src/resource_metrics.rs
new file mode 100644
index 0000000000..53c7dc5b4d
--- /dev/null
+++ b/backend/windmill-worker/src/resource_metrics.rs
@@ -0,0 +1,235 @@
+use std::sync::{atomic::Ordering, Mutex, OnceLock};
+
+use windmill_common::{
+    otel_oss::{
+        otel_add_worker_cpu, otel_record_job_memory_peak, otel_set_worker_memory,
+        otel_set_worker_occupancy_rate,
+    },
+    worker::{get_cpu_stat, get_memory, CpuStat, WORKER_GROUP},
+    OTEL_METRICS_ENABLED,
+};
+
+use crate::common::OccupancyResult;
+
+#[cfg(feature = "prometheus")]
+struct PromMetrics {
+    memory_usage: prometheus::IntGaugeVec,
+    windmill_memory_usage: prometheus::IntGaugeVec,
+    memory_limit: prometheus::IntGaugeVec,
+    cpu_usage: prometheus::CounterVec,
+    cpu_periods: prometheus::IntCounterVec,
+    cpu_throttled_periods: prometheus::IntCounterVec,
+    cpu_throttled_seconds: prometheus::CounterVec,
+    occupancy_rate: prometheus::GaugeVec,
+    job_memory_peak: prometheus::HistogramVec,
+}
+
+#[cfg(feature = "prometheus")]
+lazy_static::lazy_static! {
+    static ref PROM_METRICS: Option<PromMetrics> =
+        if windmill_common::METRICS_ENABLED.load(Ordering::Relaxed) {
+            const WORKER: &[&str] = &["name", "worker_group"];
+            Some(PromMetrics {
+                memory_usage: prometheus::register_int_gauge_vec!(
+                    "worker_memory_usage_bytes",
+                    "Memory used by the worker's container, page cache excluded",
+                    WORKER
+                )
+                .unwrap(),
+                windmill_memory_usage: prometheus::register_int_gauge_vec!(
+                    "worker_windmill_memory_usage_bytes",
+                    "Resident memory of the worker process itself",
+                    WORKER
+                )
+                .unwrap(),
+                memory_limit: prometheus::register_int_gauge_vec!(
+                    "worker_memory_limit_bytes",
+                    "Memory limit of the worker's container",
+                    WORKER
+                )
+                .unwrap(),
+                cpu_usage: prometheus::register_counter_vec!(
+                    "worker_cpu_usage_seconds_total",
+                    "CPU time consumed by the worker's container",
+                    WORKER
+                )
+                .unwrap(),
+                cpu_periods: prometheus::register_int_counter_vec!(
+                    "worker_cpu_periods_total",
+                    "CPU enforcement periods elapsed for the worker's container",
+                    WORKER
+                )
+                .unwrap(),
+                cpu_throttled_periods: prometheus::register_int_counter_vec!(
+                    "worker_cpu_throttled_periods_total",
+                    "CPU enforcement periods in which the worker's container was throttled",
+                    WORKER
+                )
+                .unwrap(),
+                cpu_throttled_seconds: prometheus::register_counter_vec!(
+                    "worker_cpu_throttled_seconds_total",
+                    "Time the worker's container spent throttled by its CPU limit",
+                    WORKER
+                )
+                .unwrap(),
+                occupancy_rate: prometheus::register_gauge_vec!(
+                    "worker_occupancy_rate",
+                    "Share of time the worker spent executing jobs, over the window",
+                    &["name", "worker_group", "window"]
+                )
+                .unwrap(),
+                job_memory_peak: prometheus::register_histogram_vec!(
+                    "worker_job_memory_peak_bytes",
+                    "Peak memory of a job's main process",
+                    &["tag"],
+                    windmill_common::worker::JOB_MEMORY_PEAK_BUCKETS.to_vec()
+                )
+                .unwrap(),
+            })
+        } else {
+            None
+        };
+}
+
+fn metrics_enabled() -> bool {
+    #[cfg(feature = "prometheus")]
+    if PROM_METRICS.is_some() {
+        return true;
+    }
+    OTEL_METRICS_ENABLED.load(Ordering::Relaxed)
+}
+
+// Memory and CPU are read from the cgroup, which every worker of a process shares
+// (native mode runs several). Only the first worker to report exports them, so that
+// summing the series over workers does not count one container several times.
+static CONTAINER_SERIES_OWNER: OnceLock<String> = OnceLock::new();
+static MEMORY_LIMIT: Mutex<Option<Option<i64>>> = Mutex::new(None);
+
+/// Replaces the exported memory limit, for the ping that re-reads the cgroup limits.
+pub(crate) fn set_memory_limit(limit: Option<i64>) {
+    *MEMORY_LIMIT.lock().unwrap() = Some(limit);
+}
+static LAST_CPU_STAT: Mutex<CpuStat> =
+    Mutex::new(CpuStat { usage_usec: 0, nr_periods: 0, nr_throttled: 0, throttled_usec: 0 });
+
+/// Exports the worker's resource readings. Meant for the ping ticks, which have already
+/// read memory usage and occupancy; the only extra work is the cgroup `cpu.stat` read.
+pub(crate) fn record_worker_resources(
+    worker_name: &str,
+    memory_usage: Option<i64>,
+    wm_memory_usage: Option<i64>,
+    occupancy: Option<&OccupancyResult>,
+) {
+    if !metrics_enabled() {
+        return;
+    }
+    let worker_group = WORKER_GROUP.as_str();
+
+    if let Some(occupancy) = occupancy {
+        let windows = [
+            ("total", Some(occupancy.occupancy_rate)),
+            ("15s", occupancy.occupancy_rate_15s),
+            ("5m", occupancy.occupancy_rate_5m),
+            ("30m", occupancy.occupancy_rate_30m),
+        ];
+        for (window, rate) in windows {
+            let Some(rate) = rate.filter(|r| r.is_finite()) else {
+                continue;
+            };
+            #[cfg(feature = "prometheus")]
+            if let Some(m) = PROM_METRICS.as_ref() {
+                m.occupancy_rate
+                    .with_label_values(&[worker_name, worker_group, window])
+                    .set(rate as f64);
+            }
+            otel_set_worker_occupancy_rate(worker_name, worker_group, window, rate as f64);
+        }
+    }
+
+    if CONTAINER_SERIES_OWNER.get_or_init(|| worker_name.to_string()) != worker_name {
+        return;
+    }
+
+    let memory_limit = *MEMORY_LIMIT.lock().unwrap().get_or_insert_with(get_memory);
+    #[cfg(feature = "prometheus")]
+    if let Some(m) = PROM_METRICS.as_ref() {
+        let labels = &[worker_name, worker_group];
+        if let Some(v) = memory_usage {
+            m.memory_usage.with_label_values(labels).set(v);
+        }
+        if let Some(v) = wm_memory_usage {
+            m.windmill_memory_usage.with_label_values(labels).set(v);
+        }
+        if let Some(v) = memory_limit {
+            m.memory_limit.with_label_values(labels).set(v);
+        }
+    }
+    otel_set_worker_memory(
+        worker_name,
+        worker_group,
+        memory_usage,
+        wm_memory_usage,
+        memory_limit,
+    );
+
+    let Some(stat) = get_cpu_stat() else {
+        return;
+    };
+    let delta = {
+        let mut last = LAST_CPU_STAT.lock().unwrap();
+        // A reading below the previous one means the cgroup changed under the process:
+        // restart from it rather than exporting a negative increase.
+        let delta = if stat.usage_usec < last.usage_usec {
+            CpuStat::default()
+        } else {
+            CpuStat {
+                usage_usec: stat.usage_usec - last.usage_usec,
+                nr_periods: stat.nr_periods.saturating_sub(last.nr_periods),
+                nr_throttled: stat.nr_throttled.saturating_sub(last.nr_throttled),
+                throttled_usec: stat.throttled_usec.saturating_sub(last.throttled_usec),
+            }
+        };
+        *last = stat;
+        delta
+    };
+    let usage_secs = delta.usage_usec as f64 / 1e6;
+    let throttled_secs = delta.throttled_usec as f64 / 1e6;
+    #[cfg(feature = "prometheus")]
+    if let Some(m) = PROM_METRICS.as_ref() {
+        let labels = &[worker_name, worker_group];
+        m.cpu_usage.with_label_values(labels).inc_by(usage_secs);
+        m.cpu_periods
+            .with_label_values(labels)
+            .inc_by(delta.nr_periods);
+        m.cpu_throttled_periods
+            .with_label_values(labels)
+            .inc_by(delta.nr_throttled);
+        m.cpu_throttled_seconds
+            .with_label_values(labels)
+            .inc_by(throttled_secs);
+    }
+    otel_add_worker_cpu(
+        worker_name,
+        worker_group,
+        usage_secs,
+        delta.nr_periods,
+        delta.nr_throttled,
+        throttled_secs,
+    );
+}
+
+/// `mem_peak_kb` is the job's `mem_peak`: non-positive when the executor had no process
+/// to sample or the reading failed, and those are not observations.
+pub(crate) fn record_job_memory_peak(tag: &str, mem_peak_kb: i32) {
+    if mem_peak_kb <= 0 {
+        return;
+    }
+    let bytes = mem_peak_kb as u64 * 1024;
+    #[cfg(feature = "prometheus")]
+    if let Some(m) = PROM_METRICS.as_ref() {
+        m.job_memory_peak
+            .with_label_values(&[tag])
+            .observe(bytes as f64);
+    }
+    otel_record_job_memory_peak(tag, bytes);
+}
diff --git a/backend/windmill-worker/src/result_processor.rs b/backend/windmill-worker/src/result_processor.rs
index 0490ed1754..12edd7823e 100644
--- a/backend/windmill-worker/src/result_processor.rs
+++ b/backend/windmill-worker/src/result_processor.rs
@@ -1776,7 +1776,7 @@ pub async fn process_completed_job(
 
         add_time!(bench, "pre add_completed_job");
 
-        let (_, duration) = add_completed_job(
+        let (_, span) = add_completed_job(
             db,
             &job,
             true,
@@ -1835,7 +1835,10 @@ pub async fn process_completed_job(
                     true,
                     canceled_by,
                     result,
-                    started_at.map(|x| FlowJobDuration { started_at: x, duration_ms: duration }),
+                    span.started_at.or(started_at).map(|x| FlowJobDuration {
+                        started_at: x,
+                        duration_ms: span.duration_ms,
+                    }),
                     StepFailureKind::Normal,
                     &same_worker_tx.expect(SAME_WORKER_REQUIREMENTS).to_owned(),
                     &worker_dir,
@@ -1867,9 +1870,10 @@ pub async fn process_completed_job(
         // `wm_failure` field) so a real runtime failure whose raw
         // result happens to contain a `wm_failure` field still goes
         // through the standard `WrappedError { error: ... }` wrap path.
-        let downstream_result: Arc<Box<RawValue>> = if is_pre_shaped_wm_failure_result(result.get())
-        {
-            windmill_queue::add_completed_job_pre_shaped_failure(
+        let (downstream_result, span): (Arc<Box<RawValue>>, _) = if is_pre_shaped_wm_failure_result(
+            result.get(),
+        ) {
+            let span = windmill_queue::add_completed_job_pre_shaped_failure(
                 db,
                 &job,
                 mem_peak.to_owned(),
@@ -1880,9 +1884,9 @@ pub async fn process_completed_job(
                 None,
             )
             .await?;
-            result.clone()
+            (result.clone(), span)
         } else {
-            let wrapped = add_completed_job_error(
+            let (wrapped, span) = windmill_queue::add_completed_job_error_with_span(
                 db,
                 &job,
                 mem_peak.to_owned(),
@@ -1895,7 +1899,10 @@ pub async fn process_completed_job(
                 None,
             )
             .await?;
-            Arc::new(serde_json::value::to_raw_value(&wrapped).unwrap())
+            (
+                Arc::new(serde_json::value::to_raw_value(&wrapped).unwrap()),
+                span,
+            )
         };
         #[cfg(all(feature = "enterprise", feature = "private"))]
         if job.kind == JobKind::DeploymentCallback {
@@ -1927,12 +1934,19 @@ pub async fn process_completed_job(
                     false,
                     canceled_by,
                     downstream_result,
-                    duration.and_then(|d| {
-                        job.started_at.map(|started_at| FlowJobDuration {
-                            started_at: started_at,
-                            duration_ms: d,
+                    if span.outlasts_run(job.started_at) {
+                        span.started_at.map(|started_at| FlowJobDuration {
+                            started_at,
+                            duration_ms: span.duration_ms,
                         })
-                    }),
+                    } else {
+                        duration.and_then(|d| {
+                            job.started_at.map(|started_at| FlowJobDuration {
+                                started_at: started_at,
+                                duration_ms: d,
+                            })
+                        })
+                    },
                     StepFailureKind::Normal,
                     &same_worker_tx.expect(SAME_WORKER_REQUIREMENTS).to_owned(),
                     &worker_dir,
diff --git a/backend/windmill-worker/src/wac_executor.rs b/backend/windmill-worker/src/wac_executor.rs
index 45d76c74e8..3cc9c1e23a 100644
--- a/backend/windmill-worker/src/wac_executor.rs
+++ b/backend/windmill-worker/src/wac_executor.rs
@@ -113,6 +113,11 @@ pub enum WacPark {
 /// handler — falls back to `now() - started_at`. Left pointing at the first segment,
 /// that fallback reports the whole sleep or approval wait as execution time.
 ///
+/// The first park keeps that first start in `extras.wac_first_started_at`, so the
+/// completed row can still say when the workflow began and how long it took overall
+/// (`Completion::execute`). The queue row's `started_at` stays per segment. The inline
+/// checkpoint requeue clears `started_at` on its own and keeps the first start the same way.
+///
 /// Call it before any write to the parent's `v2_job_status` row in the same
 /// transaction: a child's completion locks the queue row and then the status row
 /// (`record_child_completion`), and taking them the other way round here can
@@ -156,7 +161,10 @@ pub async fn suspend_wac_parent(
 
     sqlx::query!(
         "UPDATE v2_job_queue
-         SET suspend = $3, suspend_until = now() + make_interval(secs => $4), started_at = null
+         SET suspend = $3, suspend_until = now() + make_interval(secs => $4), started_at = null,
+             extras = CASE WHEN started_at IS NULL OR extras ? 'wac_first_started_at' THEN extras
+                 ELSE jsonb_set(COALESCE(extras, '{}'::jsonb), '{wac_first_started_at}', to_jsonb(started_at))
+             END
          WHERE id = $1 AND workspace_id = $2",
         job_id,
         w_id,
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index 2acafa539f..5b5df51b30 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -155,7 +155,7 @@ use crate::{
         handle_app_dependency_job, handle_dependency_job, handle_flow_dependency_job,
         tally_unfinished_dependency_deploy,
     },
-    worker_utils::{insert_ping, queue_vacuum, update_worker_ping_full},
+    worker_utils::{insert_ping, mark_worker_draining, queue_vacuum, update_worker_ping_full},
 };
 
 #[cfg(feature = "rust")]
@@ -2713,7 +2713,7 @@ pub async fn run_worker(
     let mut last_ping = Instant::now() - Duration::from_secs(NUM_SECS_PING + 1);
 
     let mut reported_ip = cached_ip();
-    let previous_jobs_executed = insert_ping(hostname, &worker_name, reported_ip, conn)
+    let previous_jobs_executed = insert_ping(hostname, &worker_name, reported_ip, true, conn)
         .await
         .expect("initial ping could be sent");
 
@@ -3160,6 +3160,31 @@ pub async fn run_worker(
 
     let mut killpill_rx2 = killpill_rx.resubscribe();
 
+    // The loop below only sees the killpill once the running job is done, which is too late
+    // for that job to learn its worker is going away.
+    {
+        let mut killpill_rx = killpill_rx.resubscribe();
+        let conn = conn.clone();
+        let worker_name = worker_name.clone();
+        tokio::spawn(async move {
+            if matches!(
+                killpill_rx.recv().await,
+                Err(broadcast::error::RecvError::Closed)
+            ) {
+                return;
+            }
+            for attempt in 1..=3 {
+                match mark_worker_draining(&conn, &worker_name).await {
+                    Ok(()) => return,
+                    Err(e) => {
+                        tracing::warn!(worker = %worker_name, "failed to mark worker as draining (attempt {attempt}/3): {e:#}");
+                        tokio::time::sleep(Duration::from_secs(2)).await;
+                    }
+                }
+            }
+        });
+    }
+
     loop {
         let last_processing_duration_secs = last_processing_duration.load(Ordering::SeqCst);
         if last_processing_duration_secs > 5 {
@@ -3235,7 +3260,7 @@ pub async fn run_worker(
             // which costs at most the last job's id here: no job of this worker is in flight at this
             // point in the loop, and the next one refills them.
             if ip_just_resolved && conn.as_sql().is_none() {
-                if let Err(e) = insert_ping(hostname, &worker_name, ip, &conn).await {
+                if let Err(e) = insert_ping(hostname, &worker_name, ip, false, &conn).await {
                     tracing::warn!(
                         worker = %worker_name, hostname = %hostname,
                         "failed to re-register with the resolved external IP: {e}"
@@ -5105,6 +5130,7 @@ pub async fn handle_queued_job(
             // WAC v2 job suspended while waiting for child jobs — don't complete it
             return Ok(JobOutcome::Completed);
         }
+        crate::resource_metrics::record_job_memory_peak(&cjob.tag, mem_peak);
         process_result(
             cjob,
             result.map(|x| Arc::new(x)),
diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index 6d76d0d771..4f67780f18 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -2097,7 +2097,7 @@ pub async fn update_flow_status_after_job_completion_internal(
             )
             .await?;
             let duration = if success {
-                let (_, duration) = add_completed_job(
+                let (_, span) = add_completed_job(
                     db,
                     &cflow_job,
                     true,
@@ -2111,9 +2111,9 @@ pub async fn update_flow_status_after_job_completion_internal(
                     false,
                 )
                 .await?;
-                duration
+                span.duration_ms
             } else {
-                let (_, duration) = add_completed_job(
+                let (_, span) = add_completed_job(
                     db,
                     &cflow_job,
                     false,
@@ -2131,7 +2131,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                     false,
                 )
                 .await?;
-                duration
+                span.duration_ms
             };
             flow_job_duration = flow_job
                 .started_at
diff --git a/backend/windmill-worker/src/worker_utils.rs b/backend/windmill-worker/src/worker_utils.rs
index 3a313e9360..c634c13b6a 100644
--- a/backend/windmill-worker/src/worker_utils.rs
+++ b/backend/windmill-worker/src/worker_utils.rs
@@ -7,9 +7,9 @@ use windmill_common::{
     external_ip::UNKNOWN_IP,
     worker::{
         get_memory, get_vcpus, get_windmill_memory_usage, get_worker_memory_usage,
-        insert_ping_query, update_job_ping_query, update_worker_ping_from_job_query,
-        update_worker_ping_main_loop_query, Connection, Ping, PingType, NATIVE_MODE_RESOLVED,
-        WORKER_CONFIG, WORKER_GROUP,
+        insert_ping_query, set_worker_draining_query, update_job_ping_query,
+        update_worker_ping_from_job_query, update_worker_ping_main_loop_query, Connection, Ping,
+        PingType, NATIVE_MODE_RESOLVED, WORKER_CONFIG, WORKER_GROUP,
     },
     KillpillSender, DB,
 };
@@ -39,17 +39,26 @@ pub(crate) async fn update_worker_ping_full(
     let wm_memory_usage = get_windmill_memory_usage();
 
     let (vcpus, memory) = if read_cgroups {
-        (get_vcpus(), get_memory())
+        let memory = get_memory();
+        crate::resource_metrics::set_memory_limit(memory);
+        (get_vcpus(), memory)
     } else {
         (None, None)
     };
 
+    let occupancy = occupancy_metrics.update_occupancy_metrics();
+    crate::resource_metrics::record_worker_resources(
+        worker_name,
+        memory_usage,
+        wm_memory_usage,
+        Some(&occupancy),
+    );
     let OccupancyResult {
         occupancy_rate,
         occupancy_rate_15s,
         occupancy_rate_5m,
         occupancy_rate_30m,
-    } = occupancy_metrics.update_occupancy_metrics();
+    } = occupancy;
 
     let ping_start = std::time::Instant::now();
     if let Err(e) = (|| {
@@ -164,6 +173,7 @@ async fn update_worker_ping_full_inner(
                         wm_memory_usage: get_windmill_memory_usage(),
                         job_isolation: None,
                         native_mode: Some(native_mode),
+                        draining: None,
                         ping_type: PingType::MainLoop,
                     },
                 )
@@ -179,6 +189,7 @@ pub async fn insert_ping(
     worker_instance: &str,
     worker_name: &str,
     ip: Option<&str>,
+    reset_draining: bool,
     db: &Connection,
 ) -> anyhow::Result<i32> {
     let (tags, dw, dws, native_mode) = {
@@ -224,6 +235,7 @@ pub async fn insert_ping(
                 memory,
                 job_isolation,
                 native_mode,
+                reset_draining.then_some(false),
                 db,
             )
             .await;
@@ -256,6 +268,7 @@ pub async fn insert_ping(
                         wm_memory_usage: get_windmill_memory_usage(),
                         job_isolation,
                         native_mode: Some(native_mode),
+                        draining: reset_draining.then_some(false),
                         ping_type: PingType::Initial,
                     },
                 )
@@ -314,6 +327,7 @@ pub async fn update_worker_ping_from_job(
                     &Ping {
                         last_job_executed: Some(job_id.clone()),
                         last_job_workspace_id: Some(w_id.to_string()),
+                        draining: None,
                         ping_type: PingType::Job,
                         worker_instance: None,
                         ip: None,
@@ -342,6 +356,45 @@ pub async fn update_worker_ping_from_job(
     Ok(())
 }
 
+/// Publishes on the worker's ping row that it has received its killpill, so the job it is
+/// still running can find out and exit early.
+pub async fn mark_worker_draining(conn: &Connection, worker_name: &str) -> anyhow::Result<()> {
+    match conn {
+        Connection::Sql(db) => set_worker_draining_query(worker_name, db).await,
+        Connection::Http(client) => {
+            client
+                .post::<Ping, ()>(
+                    UPDATE_PING_URL,
+                    None,
+                    &Ping {
+                        last_job_executed: None,
+                        last_job_workspace_id: None,
+                        draining: None,
+                        ping_type: PingType::Draining,
+                        worker_instance: None,
+                        ip: None,
+                        tags: None,
+                        dw: None,
+                        dws: None,
+                        version: None,
+                        vcpus: None,
+                        memory: None,
+                        memory_usage: None,
+                        wm_memory_usage: None,
+                        jobs_executed: None,
+                        occupancy_rate: None,
+                        occupancy_rate_15s: None,
+                        occupancy_rate_5m: None,
+                        occupancy_rate_30m: None,
+                        job_isolation: None,
+                        native_mode: None,
+                    },
+                )
+                .await
+        }
+    }
+}
+
 pub async fn ping_job_status(
     conn: &Connection,
     job_id: &Uuid,
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 281ba460b6..df2044d419 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.827.0";
+export const VERSION = "v1.828.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/chat-sdk/package-lock.json b/chat-sdk/package-lock.json
index 692e5d33f5..c6691e0048 100644
--- a/chat-sdk/package-lock.json
+++ b/chat-sdk/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-chat",
-  "version": "1.827.0",
+  "version": "1.828.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-chat",
-      "version": "1.827.0",
+      "version": "1.828.0",
       "license": "Apache-2.0",
       "devDependencies": {
         "@ai-sdk/react": "^4.0.102",
diff --git a/chat-sdk/package.json b/chat-sdk/package.json
index 287636a9f8..a119b8645d 100644
--- a/chat-sdk/package.json
+++ b/chat-sdk/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-chat",
   "description": "Build chat interfaces on Windmill flows deployed in chat mode, from any frontend or raw app",
-  "version": "1.827.0",
+  "version": "1.828.0",
   "author": "Ruben Fiszel",
   "license": "Apache-2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/chat-sdk#readme",
diff --git a/cli/src/commands/user/user.ts b/cli/src/commands/user/user.ts
index b5ed0e3196..99bea072a8 100644
--- a/cli/src/commands/user/user.ts
+++ b/cli/src/commands/user/user.ts
@@ -1,6 +1,8 @@
 import { writeFile } from "node:fs/promises";
 
 import { requireLogin } from "../../core/auth.ts";
+import { resolveWorkspace } from "../../core/context.ts";
+import { mergeConfigWithConfigFile } from "../../core/conf.ts";
 import {
   GlobalOptions,
   isSuperset,
@@ -69,6 +71,32 @@ async function list(opts: GlobalOptions) {
     .render();
 }
 
+async function listWorkspaceUsers(opts: GlobalOptions & { json?: boolean }) {
+  if (opts.json) log.setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+
+  const users = await wmill.listUsers({ workspace: workspace.workspaceId });
+
+  if (opts.json) {
+    console.log(JSON.stringify(users));
+  } else {
+    new Table()
+      .header(["username", "email", "role"])
+      .padding(2)
+      .border(true)
+      .body(
+        users.map((u) => [
+          u.username,
+          u.email,
+          u.is_admin ? "admin" : u.operator ? "operator" : "developer",
+        ])
+      )
+      .render();
+  }
+}
+
 function rdString() {
   return Math.random().toString(36).slice(2, 7);
 }
@@ -518,6 +546,9 @@ export async function pushInstanceGroups(
 const command = new Command()
   .description("user related commands")
   .action(list as any)
+  .command("list", "List the users of the workspace")
+  .option("--json", "Output as JSON (for piping to jq)")
+  .action(listWorkspaceUsers as any)
   .command("add", "Create a user")
   .arguments("<email:string> [password:string]")
   .option("--superadmin", "Specify to make the new user superadmin.")
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index d05c4e60a7..860a3ddede 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.827.0";
+export const VERSION = "1.828.0";
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 4aaf6d7e3c..eb5d46ef57 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -767,21 +767,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -837,6 +839,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -1600,21 +1610,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -1670,6 +1682,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -2539,21 +2559,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -2609,6 +2631,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -4434,10 +4464,14 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 def create_token(duration = dt.timedelta(days=1)) -> str
 
 # Create a script job by path and return its job id.
-def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# 
+# \`\`retry\`\` re-runs the job when it fails, with the policy a schedule takes,
+# e.g. \`\`{"constant": {"attempts": 3, "seconds": 10}}\`\`. The returned id is
+# the first attempt's; each retry is a job of its own, recorded as a child of it.
+def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
-# Create a script job by hash and return its job id.
-def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# Create a script job by hash and return its job id. See \`\`run_script_by_path_async\`\` for \`\`retry\`\`.
+def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
@@ -4610,6 +4644,18 @@ def set_progress(value: int, job_id: Optional[str] = None)
 #     Progress value (0-100) or None if not set
 def get_progress(job_id: Optional[str] = None) -> Any
 
+# Whether the worker running the job has received its shutdown signal.
+# 
+# A draining worker waits for its current job to finish before exiting. A long-running
+# script can poll this and return early so the worker can be replaced.
+# 
+# Args:
+#     job_id: Job ID (defaults to current WM_JOB_ID)
+# 
+# Returns:
+#     True if the worker running the job is draining
+def worker_is_draining(job_id: Optional[str] = None) -> bool
+
 # Set the user state of a flow at a given key
 def set_flow_user_state(key: str, value: Any) -> None
 
@@ -5969,6 +6015,10 @@ can call one, not an agent used as a tool.
 - \`results.step_id.property\` - Access specific property from a previous step output only when that step result is in scope
 - \`flow_input.iter.value\` - Current iteration value inside a \`forloopflow\`; in a \`whileloopflow\` it is just the iteration index (a plain number, same as \`flow_input.iter.index\`)
 - \`flow_input.iter.index\` - Current loop index when inside a loop (\`forloopflow\` or \`whileloopflow\`)
+- After a suspend step (approval), the next step's javascript expressions also get:
+  - \`resume\` - the last resume payload (the resume form values); with \`continue_on_disapprove_timeout\`, a disapproval or timeout yields \`{ error: { name: "SuspendedDisapproved" | "SuspendedTimedOut", message } }\` instead
+  - \`resumes\` - every resume payload, in arrival order
+  - \`approvers\` - a plain array of strings, one per resume: for a resume through the \`resume\`/\`cancel\` URL from \`getResumeUrls(approver)\`, the \`approver\` passed there if any; otherwise (including the \`approvalPage\` link) the resuming user's username, else \`"anonymous"\`, e.g. \`approvers[0]\`. It is NOT the \`{ resume_id, approver }\` objects stored in the flow status, so \`approvers[0].approver\` is always undefined
 
 ## Loop Structure Rules
 
@@ -6280,7 +6330,7 @@ Reference a specific resource using \`$res:\` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\\n\`memory_id\`). Without a memory id the agent runs without memory.\\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the \`memory_id\` here.\\nThe step's own \`memory_id\` is not read while this kind is set; switch the kind to \`window\`\\nto use it. Without a \`context_length\`, or with 0, it is \`off\` and reads \`previous_messages\`.\\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's \`memory_id\`), replacing\\nits older part with a summary as the conversation approaches the model's context window.\\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\\nWindmill does not know needs one; those fall back to 128000.\\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to \`off\` with \`previous_messages\` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see \`memory_id\`. While it is off, a step can supply its history in \`previous_messages\`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\\nflow.input syntax. Required unless memory is off and \`previous_messages\` supplies\\nthe prompt; image output always needs it.\\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\\nwas started with (the chat conversation, an app chat session or the \`memory_id\` run\\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\\nacross every run; an expression such as \`flow_input.customer_id\` keeps one memory per\\nkey. When it evaluates to an empty value the agent runs without memory. Read only\\nwhile \`memory\` is \`window\` or \`compaction\`: it is ignored when memory is off, and an\\nolder \`auto\` or \`manual\` memory reads neither history input.\\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\\nand the user message. Read only while \`memory\` is off or absent: managed memory\\nignores it, and an older \`auto\` or \`manual\` memory reads neither history input.\\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in \`tools\` the agent may call\\nthis run. Leaving it unset carries every one of them; an empty array carries none.\\nA tool is named as the model is shown it. An entry the model is shown nothing of is\\nnamed by what identifies it instead: an MCP server by its resource path, carrying\\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\\n(no tool may take that name).\\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\\nstate with calibrated probabilities, instead of generating text.\\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\\nthe answers, follow it with a branchone whose branch exprs read\\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\\nsupplies the state.\\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\\nAn object with descriptive keys holding only what the questions need works best.\\nExample: { message: flow_input.message, plan: results.a.plan }\\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\\n- 'choice': criteria maps each option to its description (up to 255); the answer\\n  has choice, probabilities and confidence\\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\\n  has score, legend, probabilities and confidence\\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\\n  noul, the probability of yes (0 to 1)\\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default \`flow\`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff: the n-th retry waits multiplier \\u00d7 seconds^n","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Base of the exponential (seconds); the n-th retry waits multiplier \\u00d7 seconds^n, where n counts constant retries too"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\\n\`memory_id\`). Without a memory id the agent runs without memory.\\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the \`memory_id\` here.\\nThe step's own \`memory_id\` is not read while this kind is set; switch the kind to \`window\`\\nto use it. Without a \`context_length\`, or with 0, it is \`off\` and reads \`previous_messages\`.\\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's \`memory_id\`), replacing\\nits older part with a summary as the conversation approaches the model's context window.\\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\\nWindmill does not know needs one; those fall back to 128000.\\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to \`off\` with \`previous_messages\` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see \`memory_id\`. While it is off, a step can supply its history in \`previous_messages\`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\\nflow.input syntax. Required unless memory is off and \`previous_messages\` supplies\\nthe prompt; image output always needs it.\\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\\nwas started with (the chat conversation, an app chat session or the \`memory_id\` run\\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\\nacross every run; an expression such as \`flow_input.customer_id\` keeps one memory per\\nkey. When it evaluates to an empty value the agent runs without memory. Read only\\nwhile \`memory\` is \`window\` or \`compaction\`: it is ignored when memory is off, and an\\nolder \`auto\` or \`manual\` memory reads neither history input.\\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\\nand the user message. Read only while \`memory\` is off or absent: managed memory\\nignores it, and an older \`auto\` or \`manual\` memory reads neither history input.\\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in \`tools\` the agent may call\\nthis run. Leaving it unset carries every one of them; an empty array carries none.\\nA tool is named as the model is shown it. An entry the model is shown nothing of is\\nnamed by what identifies it instead: an MCP server by its resource path, carrying\\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\\n(no tool may take that name).\\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\\nstate with calibrated probabilities, instead of generating text.\\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\\nthe answers, follow it with a branchone whose branch exprs read\\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\\nsupplies the state.\\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\\nAn object with descriptive keys holding only what the questions need works best.\\nExample: { message: flow_input.message, plan: results.a.plan }\\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\\n- 'choice': criteria maps each option to its description (up to 255); the answer\\n  has choice, probabilities and confidence\\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\\n  has score, legend, probabilities and confidence\\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\\n  noul, the probability of yes (0 to 1)\\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default \`flow\`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
 `,
   "raw-app": `---
 name: raw-app
@@ -7865,10 +7915,48 @@ A **data pipeline** is NOT a flow. A flow is one runnable that orchestrates step
 A pipeline node that produces a table should almost always be a **\`duckdb\`** node that materializes its output into a **DuckLake** table with \`-- materialize ducklake://<name>/<table>\` (in a DuckDB node the annotation uses SQL \`--\` comment syntax; write the body as a bare \`SELECT\` and let the runtime do the write). DuckLake is the default lakehouse store for pipelines and is the shape the pipeline editor is built around, so prefer it unless the work specifically calls for something else:
 
 - \`postgresql\` / data tables — only for row-level, OLTP-style mutations against an existing Postgres data table (frequent single-row upserts/updates, transactional reads that an app queries live).
-- \`bun\` / \`python3\` — only for non-tabular work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node still produces tabular data for downstream steps, land it in DuckLake (write it with the wmill SDK / ducklake helpers) rather than inventing a parallel store.
+- \`bun\` / \`python3\` — only for work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node produces tabular data for downstream steps, write it **straight into DuckLake** (or a data table) from the same script — see "Ingesting from Python / TypeScript" below — rather than inventing a parallel store.
 
 Do not spread a pipeline across postgres, S3, and DuckLake when one DuckLake lake would do; a consistent DuckLake lakehouse is the goal.
 
+## Ingesting from Python / TypeScript
+
+A node that fetches data in code (an API, a SaaS export, a scraper) writes the rows **directly** into their DuckLake table with \`wmill.ducklake()\`, or into a data table with \`wmill.datatable()\`. DuckLake already stores every table as parquet files in the workspace object storage, so **never stage the raw payload first** — no intermediate JSON / CSV / parquet file in S3 and no second "load the raw file" node. One ingestion node, one table.
+
+Pass the rows as a query argument (a list of dicts / array of objects is sent as JSON) and let SQL unnest them; declare the column types so the table gets a real schema:
+
+\`\`\`python
+# pipeline
+# on schedule
+import wmill
+
+def main():
+    rows = fetch_charges()  # list[dict]
+    lake = wmill.ducklake()
+    lake.query("""
+        CREATE OR REPLACE TABLE stripe_charges AS
+        SELECT unnest(from_json($rows, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)
+    """, rows=rows).fetch()
+\`\`\`
+
+\`\`\`ts
+// pipeline
+// on schedule
+import * as wmill from "windmill-client"
+
+export async function main() {
+  const rows = await fetchCharges()
+  const lake = wmill.ducklake()
+  await lake\`CREATE OR REPLACE TABLE stripe_charges AS
+    SELECT unnest(from_json(\${rows}, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)\`.fetch()
+}
+\`\`\`
+
+- Use \`INSERT INTO <table> SELECT ...\` instead of \`CREATE OR REPLACE\` to append (an incremental pull), with a one-time \`CREATE TABLE IF NOT EXISTS\` first.
+- Assign the client to a variable (\`lake = wmill.ducklake()\`) and keep the SQL a **string literal** (Python) or a template without \`sql.raw\` (TS): that is what lets the graph record the node's write to \`ducklake://main/<table>\`. A chained \`wmill.ducklake().query(...)\` or SQL built in a variable records no output, so the downstream edge never forms.
+- \`wmill.ducklake("<name>")\` targets a non-default catalog; \`wmill.datatable("<name>")\` writes a Postgres data table the same way (Python \`db.query(sql, *args)\` with \`$1\` placeholders, TS the same template form) — use it only when the data belongs in Postgres (see above).
+- The downstream node triggers on the table itself: \`-- on ducklake://main/stripe_charges\`.
+
 ## Storage prerequisites
 
 A DuckLake pipeline only runs once the workspace has **object storage** (S3 / Azure Blob / GCS) **and a DuckLake catalog** configured — DuckLake tables and \`s3://\` assets can't be materialized or read without it. Check which DuckLake catalogs the workspace has before you build.
@@ -7912,7 +8000,7 @@ The key must be a **string literal** — the graph parser is static and cannot f
 
 ## Materialize (the managed output)
 
-> **A MANAGED \`// materialize\` is DuckDB-only**, and its target must be a DuckLake table (\`ducklake://<name>/<table>\`). Deploy **rejects** a \`ducklake://\` \`// materialize\` on any other language (\`python3\`, \`bun\`, \`postgresql\`). For a non-DuckDB node writing the lake, do **not** use \`// materialize\` — write the output via the SDK (\`wmill.writeS3File(...)\`, ducklake helpers, …) and let it be inferred. Use \`duckdb\` when a node should materialize a DuckLake table.
+> **A MANAGED \`// materialize\` is DuckDB-only**, and its target must be a DuckLake table (\`ducklake://<name>/<table>\`). Deploy **rejects** a \`ducklake://\` \`// materialize\` on any other language (\`python3\`, \`bun\`, \`postgresql\`). For a non-DuckDB node writing the lake, do **not** use \`// materialize\` — write the table itself with \`wmill.ducklake()\` (see "Ingesting from Python / TypeScript") and let the output be inferred. Use \`duckdb\` when a node should materialize a DuckLake table.
 >
 > The one target ANY language may declare (except a dbt script, whose writes come from its manifest) is a **warehouse relation**: \`// materialize manual dbt://<warehouse>/<schema>/<name>\`, where \`<warehouse>\` is a warehouse the workspace configures under Settings → dbt. \`manual\` is the only mode it has — nothing generates warehouse DDL, so the node issues its own write (a postgresql \`CREATE TABLE\` / \`INSERT\`, an SDK load, …) and the annotation records the outcome. Use it on an ingestion node whose output a dbt project reads as a \`source\`: the declared relation and the dbt model land on ONE graph node, and a downstream \`// on dbt://<warehouse>/<schema>/<name>\` fires when the ingestion node completes.
 
@@ -8711,6 +8799,8 @@ user related commands
 
 **Subcommands:**
 
+- \`user list\` - List the users of the workspace
+  - \`--json\` - Output as JSON (for piping to jq)
 - \`user add <email:string> [password:string]\` - Create a user
   - \`--superadmin\` - Specify to make the new user superadmin.
   - \`--company <company:string>\` - Specify to set the company of the new user.
@@ -9061,7 +9151,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9072,7 +9163,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9160,7 +9252,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9171,7 +9264,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9244,7 +9338,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9255,7 +9350,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9365,7 +9461,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9376,7 +9473,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9528,7 +9626,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9539,7 +9638,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9697,7 +9797,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9708,7 +9809,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9823,7 +9925,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9834,7 +9937,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9921,7 +10025,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9932,7 +10037,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -10013,7 +10119,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -10024,7 +10131,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -10111,7 +10219,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -10122,7 +10231,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -10262,7 +10372,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -10273,7 +10384,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -10463,7 +10575,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -10474,7 +10587,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/docs/pipeline-local-dev.md b/docs/pipeline-local-dev.md
index e05acec9f0..fb8d49b296 100644
--- a/docs/pipeline-local-dev.md
+++ b/docs/pipeline-local-dev.md
@@ -69,7 +69,7 @@ makes the client own the whole cascade so the backend dispatcher never double-fi
 - `frontend/src/lib/components/assets/AssetGraph/cascadeRun.ts` — reusable run primitives
   (`makeLaunch`, `makeWaitJobTerminal`, `runDownstreamCascade`, `runBoundedCascade`) wrapping
   `cascadeOrchestrator` + `graphTraversal`.
-- `frontend/src/lib/components/assets/AssetGraph/PipelineDevView.svelte` + `frontend/src/routes/pipeline_dev/+page.svelte`.
+- `frontend/src/lib/components/assets/AssetGraph/PipelineDevView.svelte` + `frontend/src/routes/(styled)/pipeline_dev/+page.svelte`.
 
 **Modified**
 - `cli/src/commands/pipeline/pipeline.ts` — `--local` on `show`/`run`; `show` split into graph
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 2f5ea5b721..28ecbebf42 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.827.0",
+	"version": "1.828.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.827.0",
+			"version": "1.828.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 4515459ba3..cc42f5424a 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.827.0",
+	"version": "1.828.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/frontend/src/app.html b/frontend/src/app.html
index aad967fd91..3c9e232e0f 100644
--- a/frontend/src/app.html
+++ b/frontend/src/app.html
@@ -12,6 +12,17 @@
 				fill: #3b82f6;
 			}
 
+			/* Public app pages render their shell before app.css loads, if at all. */
+			html[data-wm-public-app] #svelte-global-loader {
+				display: none;
+			}
+			html[data-wm-public-app] body {
+				margin: 0;
+			}
+			html[data-wm-public-app='dark'] body {
+				background-color: #3b4252;
+			}
+
 			/* Background color for dark mode */
 			@media (prefers-color-scheme: dark) {
 				#mainbg {
@@ -123,6 +134,64 @@
 				}
 			})()
 		</script>
+		<script>
+			// Public app pages (`/public/<ws>/<secret>`, `/a/<custom path>`): skip the loading
+			// screen, and start the API calls the page makes first so they overlap the module
+			// download instead of following it. `publicAppApi.ts` takes these responses by URL,
+			// so each URL here must be exactly what it requests. Only the cookie credential is
+			// prefetched: a share link carrying a JWT, or the opaque viewer frame (`wm_embed`),
+			// sends its own and fetches normally. The bundle of an unsandboxed raw app is
+			// requested as soon as its secret is known, for the iframe to find in the HTTP cache.
+			;(function () {
+				var path = location.pathname
+				var pub = /^\/public\/([^/]+)\/([^/]+)\/?$/.exec(path)
+				var custom = /^\/a\/(.+?)\/?$/.exec(path)
+				if (!pub && !custom && !/^\/public\//.test(path)) return
+				// Dark as PublicApp decides it, painted before any stylesheet so that a dark app
+				// does not load over a white page.
+				var dark = false
+				try {
+					var mode = localStorage.getItem('dark-mode')
+					dark = mode ? mode === 'dark' : matchMedia('(prefers-color-scheme: dark)').matches
+				} catch (_) {}
+				document.documentElement.setAttribute('data-wm-public-app', dark ? 'dark' : '')
+				if (new URLSearchParams(location.search).get('wm_embed') === '1') return
+				var prefetched = (window.__wmPublicAppPrefetch = {})
+				function get(url) {
+					var res = fetch(url)
+					res.catch(function () {})
+					prefetched[url] = res
+					return res
+				}
+				function warmBundle(appRes, workspace) {
+					appRes
+						.then(function (r) {
+							return r.ok ? r.clone().json() : null
+						})
+						.then(function (app) {
+							if (!app || !app.raw_app || !app.bundle_secret || (app.policy || {}).sandbox) return
+							var ws = workspace || app.workspace_id
+							var v = '/api/w/' + ws + '/apps_u/get_data/v/' + app.bundle_secret
+							fetch(v + '.css').catch(function () {})
+							fetch(v + '.js').catch(function () {})
+						})
+						.catch(function () {})
+				}
+				if (pub) {
+					var w = '/api/w/' + pub[1]
+					get(w + '/apps_u/embed_token/' + pub[2])
+					warmBundle(get(w + '/apps_u/public_app/' + pub[2]), pub[1])
+					get(w + '/apps_u/guest_entry/' + pub[2])
+					get(w + '/users/whoami')
+				} else if (custom && custom[1].indexOf('.') === -1) {
+					// A `.` marks a trailing JWT segment, which no custom path contains.
+					get('/api/apps_u/embed_token_by_custom_path/' + custom[1])
+					warmBundle(get('/api/apps_u/public_app_by_custom_path/' + custom[1]))
+					get('/api/apps_u/guest_entry_by_custom_path/' + custom[1])
+				}
+				get('/api/ee_license')
+			})()
+		</script>
 		%sveltekit.head%
 	</head>
 	<body data-sveltekit-preload-code="viewport" class="outline-none focus:outline-none">
diff --git a/frontend/src/lib/apiBaseUrl.svelte.ts b/frontend/src/lib/apiBaseUrl.svelte.ts
new file mode 100644
index 0000000000..f87a33f0d8
--- /dev/null
+++ b/frontend/src/lib/apiBaseUrl.svelte.ts
@@ -0,0 +1,22 @@
+import { fromStore } from 'svelte/store'
+import { base } from '$lib/base'
+import { instanceUi } from '$lib/instanceUi'
+
+const ui = fromStore(instanceUi)
+
+/**
+ * Base of every URL shown for an external client to call (webhooks, HTTP routes, push
+ * trigger endpoints, the CLI remote): the `api_base_url` instance setting, else the
+ * origin being browsed. Append `/api/...` to it.
+ *
+ * Not for URLs the editor itself calls or opens (captures, previews, OAuth popups, links
+ * to pages): those must stay on the browsing origin, where the session cookie lives.
+ *
+ * Reactive: the setting lands after page load, so read it inside a `$derived` or the
+ * template rather than caching the result.
+ */
+export function apiBaseUrl(): string {
+	const setting = ui.current?.api_base_url
+	const configured = typeof setting === 'string' ? setting.trim() : ''
+	return configured || `${window.location.origin}${base}`
+}
diff --git a/frontend/src/lib/components/AutosaveIndicator.svelte b/frontend/src/lib/components/AutosaveIndicator.svelte
index 76dc030c58..1e318ed9b2 100644
--- a/frontend/src/lib/components/AutosaveIndicator.svelte
+++ b/frontend/src/lib/components/AutosaveIndicator.svelte
@@ -142,7 +142,13 @@
 	let hintTimer: ReturnType<typeof setTimeout> | undefined
 
 	const kindLabel = $derived(
-		itemKind === 'flow' ? 'flow' : itemKind === 'app' || itemKind === 'raw_app' ? 'app' : 'script'
+		itemKind === 'flow'
+			? 'flow'
+			: itemKind === 'app' || itemKind === 'raw_app'
+				? 'app'
+				: itemKind === 'data_pipeline'
+					? 'pipeline'
+					: 'script'
 	)
 
 	// Each false → true transition fires a hint (others > loaded). Seeded to
diff --git a/frontend/src/lib/components/BreadcrumbItemContent.svelte b/frontend/src/lib/components/BreadcrumbItemContent.svelte
new file mode 100644
index 0000000000..9e945586c7
--- /dev/null
+++ b/frontend/src/lib/components/BreadcrumbItemContent.svelte
@@ -0,0 +1,16 @@
+<!--
+@component
+The inside of one breadcrumb part: an optional leading icon and the label.
+
+Every part of the header's breadcrumb renders this, whether its dropdown is a melt menu or a
+popover, so they share one look. Separators are the host's job — a part must not contain the
+slash before it, or hovering the part would highlight the separator too.
+-->
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+
+	let { label, icon }: { label: string; icon?: Snippet } = $props()
+</script>
+
+{@render icon?.()}
+<span class="truncate">{label}</span>
diff --git a/frontend/src/lib/components/BreadcrumbSegment.svelte b/frontend/src/lib/components/BreadcrumbSegment.svelte
index 8a266e4fc4..4d55675f26 100644
--- a/frontend/src/lib/components/BreadcrumbSegment.svelte
+++ b/frontend/src/lib/components/BreadcrumbSegment.svelte
@@ -6,7 +6,7 @@ state — switching popovers relies on melt-ui's `closeOnOtherPopoverOpen` to
 close siblings.
 -->
 <script lang="ts">
-	import { ChevronRight } from 'lucide-svelte'
+	import BreadcrumbItemContent from './BreadcrumbItemContent.svelte'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import WorkspaceItemDrillPicker, {
 		type Scope
@@ -15,7 +15,8 @@ close siblings.
 
 	interface Props {
 		label: string
-		withChevron?: boolean
+		/** Leading glyph, e.g. the folder or user a path scope names. */
+		icon?: import('svelte').Snippet
 		extraClass?: string
 		disabled?: boolean
 		/** Where the picker lands when this segment is clicked. */
@@ -33,7 +34,7 @@ close siblings.
 
 	let {
 		label,
-		withChevron = false,
+		icon,
 		extraClass = '',
 		disabled = false,
 		initialScope,
@@ -71,8 +72,7 @@ close siblings.
 	{disabled}
 >
 	{#snippet trigger()}
-		{#if withChevron}<ChevronRight size={10} class="shrink-0" /><span class="truncate">{label}</span
-			>{:else}{label}{/if}
+		<BreadcrumbItemContent {label} {icon} />
 	{/snippet}
 	{#snippet content()}
 		<WorkspaceItemDrillPicker
diff --git a/frontend/src/lib/components/CenteredModal.svelte b/frontend/src/lib/components/CenteredModal.svelte
index 08234c25b1..3e922e73c7 100644
--- a/frontend/src/lib/components/CenteredModal.svelte
+++ b/frontend/src/lib/components/CenteredModal.svelte
@@ -16,6 +16,9 @@
 		containOverflow?: boolean
 		/** The Windmill version and update notice in the header. */
 		showVersion?: boolean
+		/** Set on the pages that render inside the app shell, under the page header: there the
+		 * window is not the card's box, and taking the whole of it pushes 44px past the bottom. */
+		inPage?: boolean
 		children?: import('svelte').Snippet
 	}
 
@@ -28,6 +31,7 @@
 		loading = false,
 		containOverflow = false,
 		showVersion = true,
+		inPage = false,
 		children
 	}: Props = $props()
 
@@ -37,7 +41,9 @@
 </script>
 
 <div
-	class="flex justify-center h-screen p-4 relative bg-surface-secondary {containOverflow
+	class="flex justify-center {inPage
+		? 'h-full'
+		: 'h-screen'} p-4 relative bg-surface-secondary {containOverflow
 		? 'overflow-hidden'
 		: 'overflow-auto'}"
 	class:items-center={centerVertically}
diff --git a/frontend/src/lib/components/CliHelpBox.svelte b/frontend/src/lib/components/CliHelpBox.svelte
index 0bee33825c..e91b039328 100644
--- a/frontend/src/lib/components/CliHelpBox.svelte
+++ b/frontend/src/lib/components/CliHelpBox.svelte
@@ -2,10 +2,11 @@
 	import ClipboardPanel from './details/ClipboardPanel.svelte'
 	import Section from './Section.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
 
-	let url = $derived(`${window.location.protocol}//${window.location.hostname}/`)
+	let url = $derived(`${apiBaseUrl()}/`)
 </script>
 
 <Section label="CLI quick setup">
diff --git a/frontend/src/lib/components/CompareWorkspaces.svelte b/frontend/src/lib/components/CompareWorkspaces.svelte
index 375e73480e..9696836dfd 100644
--- a/frontend/src/lib/components/CompareWorkspaces.svelte
+++ b/frontend/src/lib/components/CompareWorkspaces.svelte
@@ -1,9 +1,9 @@
 <script lang="ts">
 	import {
 		AlertTriangle,
-		ArrowDownRight,
+		ArrowDown,
 		ArrowRight,
-		ArrowUpRight,
+		ArrowUp,
 		Building,
 		CircleCheck,
 		CircleX,
@@ -16,7 +16,7 @@
 		RefreshCw,
 		UserPlus
 	} from 'lucide-svelte'
-	import { untrack } from 'svelte'
+	import { onDestroy, untrack } from 'svelte'
 	import type { CiTestResult } from '$lib/gen'
 	import { Alert, Badge } from './common'
 	import {
@@ -97,6 +97,8 @@
 		onRetry?: () => void
 		onSelectTarget?: (target: string) => void
 		comparison: WorkspaceComparison | undefined
+		/** The comparison is still in flight, so an empty list says nothing yet. */
+		comparisonLoading?: boolean
 		/** Set when the comparison request failed (e.g. not an admin of the target). */
 		comparisonError?: string
 		/** Initial merge direction; lets the page restore the chosen direction when
@@ -144,6 +146,7 @@
 		onRetry,
 		onSelectTarget,
 		comparison,
+		comparisonLoading = false,
 		comparisonError,
 		initialMergeIntoParent = true,
 		deployCount = 0,
@@ -486,6 +489,12 @@
 	// Summary cache: stores summaries from both workspaces
 	type SummaryCache = Record<string, { current?: string; parent?: string; loading?: boolean }>
 	let summaryCache = $state<SummaryCache>({})
+	// What has already been asked for. Deliberately not `$state`: the fetchers below run inside an
+	// effect, and a guard that reads reactive state makes that effect depend on what it writes —
+	// which is a loop. A plain Set is also what tells "asked, and the answer was nothing" from
+	// "never asked", which a value map cannot when the value for both is `undefined`.
+	const summariesRequested = new Set<string>()
+	const onBehalfOfRequested = new Set<string>()
 
 	// On-behalf-of tracking for flows and scripts
 	// Source workspace on_behalf_of emails (keyed by workspace/kind:path)
@@ -499,51 +508,101 @@
 		return `${diff.kind}:${diff.path}`
 	}
 
+	/** The two things a row needs from an item — the name it shows and who it runs as — are fields
+	 *  of the same object, so it is read once per item per workspace and awaited by both loops.
+	 *
+	 *  `SHARED_READ_KINDS` is the kinds that carry both. A folder has a summary and no identity; a
+	 *  schedule or a trigger has an identity read from its own endpoint, which `getOnBehalfOf`
+	 *  dispatches. */
+	const SHARED_READ_KINDS = ['script', 'flow', 'app', 'raw_app']
+	type ItemRead = { summary?: string; onBehalfOf?: string }
+	const itemReads = new Map<string, Promise<ItemRead>>()
+
+	function readItem(kind: string, path: string, workspace: string): Promise<ItemRead> {
+		const key = `${workspace}/${kind}:${path}`
+		let pending = itemReads.get(key)
+		if (!pending) {
+			// A failure is not an answer, so it is not kept: held, it would read as "this item has
+			// no identity", which is what decides whether the deploy offers to preserve one — and
+			// an item deployed without it silently becomes the deployer's. Each caller swallows its
+			// own, as both did before they shared a read.
+			pending = loadItem(kind, path, workspace).catch((error) => {
+				itemReads.delete(key)
+				throw error
+			})
+			itemReads.set(key, pending)
+		}
+		return pending
+	}
+
+	async function loadItem(kind: string, path: string, workspace: string): Promise<ItemRead> {
+		if (kind === 'script') {
+			const script = await ScriptService.getScriptByPath({ workspace, path })
+			return { summary: script.summary, onBehalfOf: script.on_behalf_of_email }
+		} else if (kind === 'flow') {
+			const flow = await FlowService.getFlowByPath({ workspace, path })
+			return { summary: flow.summary, onBehalfOf: flow.on_behalf_of_email }
+		} else if (kind === 'app' || kind === 'raw_app') {
+			const app = await AppService.getAppByPath({ workspace, path })
+			return { summary: app.summary, onBehalfOf: app.policy?.on_behalf_of_email }
+		} else if (kind === 'folder') {
+			const folder = await FolderService.getFolder({ workspace, name: path.replace(/^f\//, '') })
+			return { summary: folder.summary }
+		}
+		return {}
+	}
+
 	async function fetchSummary(
 		kind: string,
 		path: string,
 		workspace: string
 	): Promise<string | undefined> {
 		try {
-			if (kind === 'script') {
-				const script = await ScriptService.getScriptByPath({ workspace, path })
-				return script.summary
-			} else if (kind === 'flow') {
-				const flow = await FlowService.getFlowByPath({ workspace, path })
-				return flow.summary
-			} else if (kind === 'app' || kind === 'raw_app') {
-				const app = await AppService.getAppByPath({ workspace, path })
-				return app.summary
-			} else if (kind === 'folder') {
-				const folder = await FolderService.getFolder({ workspace, name: path.replace(/^f\//, '') })
-				return folder.summary
-			}
+			return (await readItem(kind, path, workspace)).summary
 		} catch (error) {
 			console.error(`Failed to fetch summary for ${kind}:${path}`, error)
+			return undefined
 		}
-		return undefined
 	}
 
+	// Both loops below run one item at a time and outlive the mount that started them: the page
+	// remounts this component when either side of the pair changes, and whatever was in flight then
+	// still resolves. It must not be stored — the summary key is kind and path, which the other
+	// pair spells the same way — and the loop must not keep asking for a pair nobody is looking at.
+	let alive = true
+	onDestroy(() => {
+		alive = false
+	})
+
 	async function fetchSummaries(diffs: WorkspaceItemDiff[]) {
 		// Only fetch summaries for scripts, flows, and apps
 		const itemsToFetch = diffs.filter((diff) =>
 			['script', 'flow', 'app', 'raw_app', 'folder'].includes(diff.kind)
 		)
+		// Read once, so every request in this pass names the pair the pass was started for. Named
+		// the way the diff names the two sides: `exists_in_fork` is this workspace, `exists_in_source`
+		// the one it is compared against.
+		const forkWs = currentWorkspaceId
+		const sourceWs = parentWorkspaceId
 
 		for (const diff of itemsToFetch) {
+			if (!alive) return
 			const key = getItemKey(diff)
 
-			// Skip if already cached or loading
-			if (summaryCache[key]) continue
+			// Asked for already — including one still in flight, and one whose answer was nothing.
+			if (summariesRequested.has(key)) continue
+			summariesRequested.add(key)
 
-			// Mark as loading
 			summaryCache[key] = { loading: true }
 
-			// Fetch from both workspaces in parallel
+			// Only the sides that have the item. An item that is only ahead does not exist in the
+			// other workspace, so asking it there is a 404 by construction — a guaranteed-failing
+			// request per one-sided row, and a console error for each.
 			const [currentSummary, parentSummary] = await Promise.all([
-				fetchSummary(diff.kind, diff.path, currentWorkspaceId),
-				fetchSummary(diff.kind, diff.path, parentWorkspaceId)
+				diff.exists_in_fork ? fetchSummary(diff.kind, diff.path, forkWs) : undefined,
+				diff.exists_in_source ? fetchSummary(diff.kind, diff.path, sourceWs) : undefined
 			])
+			if (!alive) return
 
 			summaryCache[key] = {
 				current: currentSummary,
@@ -561,18 +620,32 @@
 			(d) =>
 				['flow', 'script', 'app', 'raw_app'].includes(d.kind) || isTriggerOrScheduleKind(d.kind)
 		)
+		const pair = [
+			{ workspace: currentWorkspaceId, side: 'fork' as const },
+			{ workspace: parentWorkspaceId, side: 'source' as const }
+		]
 		for (const diff of itemsWithOnBehalfOf) {
-			for (const workspace of [currentWorkspaceId, parentWorkspaceId]) {
+			for (const { workspace, side } of pair) {
+				if (!alive) return
 				const workspacedKey = getWorkspacedKey(workspace, getItemKey(diff))
-				if (onBehalfOfInfo[workspacedKey] !== undefined) continue
+				// Marked before the request, not after it answers: a guard keyed on the value it
+				// stores (`undefined` either way) would ask again on every pass, forever.
+				if (onBehalfOfRequested.has(workspacedKey)) continue
+				onBehalfOfRequested.add(workspacedKey)
+				// The side that does not have the item has nothing to say about who it runs as, and
+				// asking produces a 404 rather than an answer.
+				if (!(side === 'fork' ? diff.exists_in_fork : diff.exists_in_source)) continue
 
 				try {
-					onBehalfOfInfo[workspacedKey] = await getOnBehalfOf(
-						diff.kind as Kind,
-						diff.path,
-						workspace
-					)
+					// The same read the summary loop does, for the kinds that answer both from one
+					// object; the rest keep their own endpoint.
+					const email = SHARED_READ_KINDS.includes(diff.kind)
+						? (await readItem(diff.kind, diff.path, workspace)).onBehalfOf
+						: await getOnBehalfOf(diff.kind as Kind, diff.path, workspace)
+					if (!alive) return
+					onBehalfOfInfo[workspacedKey] = email
 				} catch {
+					if (!alive) return
 					onBehalfOfInfo[workspacedKey] = undefined
 				}
 			}
@@ -1004,11 +1077,16 @@
 		)
 	)
 
-	// Fetch summaries and on_behalf_of_email when comparison data loads
+	// Fetch summaries and on_behalf_of_email when comparison data loads. `untrack`: both fetchers
+	// write the state they also read, and without this the effect depends on their writes and
+	// re-runs on each one.
 	$effect(() => {
-		if (comparison?.diffs) {
-			fetchSummaries(comparison.diffs)
-			fetchOnBehalfOfInfo(comparison.diffs)
+		const diffs = comparison?.diffs
+		if (diffs) {
+			untrack(() => {
+				fetchSummaries(diffs)
+				fetchOnBehalfOfInfo(diffs)
+			})
 		}
 	})
 
@@ -1229,6 +1307,7 @@
 				onSelectAll={selectAll}
 				onDeselectAll={deselectAll}
 				emptyMessage={emptyDeployMessage}
+				loading={comparisonLoading}
 			>
 				{#snippet header()}
 					<div class="flex items-center justify-between bg-surface-tertiary">
@@ -1650,13 +1729,13 @@
 							{#if isConflict || existsInBothWorkspaces}
 								{#if diff.ahead > 0}
 									<Badge color="green" size="xs">
-										<ArrowUpRight class="w-3 h-3 inline" />
+										<ArrowUp class="w-3 h-3 inline" />
 										{diff.ahead} ahead
 									</Badge>
 								{/if}
 								{#if diff.behind > 0}
 									<Badge color="blue" size="xs">
-										<ArrowDownRight class="w-3 h-3 inline" />
+										<ArrowDown class="w-3 h-3 inline" />
 										{diff.behind} behind
 									</Badge>
 								{/if}
diff --git a/frontend/src/lib/components/ContextBridge.svelte b/frontend/src/lib/components/ContextBridge.svelte
new file mode 100644
index 0000000000..069bec0f42
--- /dev/null
+++ b/frontend/src/lib/components/ContextBridge.svelte
@@ -0,0 +1,18 @@
+<!--
+@component
+Re-exposes contexts from one component tree inside another.
+
+A snippet handed to the page header renders under the header, not under the page that wrote it, so
+any component it creates looks its contexts up in the header's tree and finds nothing. The page
+passes the entries its buttons need and this sets them again around the render.
+-->
+<script lang="ts">
+	import { setContext, type Snippet } from 'svelte'
+
+	let { contexts, children }: { contexts?: Map<any, any>; children: Snippet } = $props()
+
+	// setContext only takes effect during init, so this instance is keyed on `contexts` by callers.
+	if (contexts) for (const [key, value] of contexts) setContext(key, value)
+</script>
+
+{@render children()}
diff --git a/frontend/src/lib/components/CronBuilder.svelte b/frontend/src/lib/components/CronBuilder.svelte
index bcf8508c12..3bceabb417 100644
--- a/frontend/src/lib/components/CronBuilder.svelte
+++ b/frontend/src/lib/components/CronBuilder.svelte
@@ -15,7 +15,7 @@
 	contentClasses="p-4"
 >
 	{#snippet trigger()}
-		<Button variant="accent" size="xs" nonCaptureEvent={true} startIcon={{ icon: Clock }}>
+		<Button variant="default" unifiedSize="sm" nonCaptureEvent={true} startIcon={{ icon: Clock }}>
 			Cron builder
 		</Button>
 	{/snippet}
diff --git a/frontend/src/lib/components/DBManager.svelte b/frontend/src/lib/components/DBManager.svelte
index 5204a876b9..837569c575 100644
--- a/frontend/src/lib/components/DBManager.svelte
+++ b/frontend/src/lib/components/DBManager.svelte
@@ -375,7 +375,8 @@
 			}
 		if (!isInstanceDatatable(datatable))
 			return {
-				reason: 'Only data tables stored in the instance database have roles and grants.',
+				reason:
+					"Roles and grants are not supported on data tables backed by a Postgres resource. Store the data table on Windmill's database or on an external Postgres instance (set up by a superadmin in instance settings) to use them.",
 				ee: false
 			}
 		if (needsAdmin && !canManageDatatable)
@@ -458,6 +459,11 @@
 	// default to open — actually be folded; a plain "expanded" set could never
 	// close them, since the default would keep winning.
 	// What the permissions drawer is open on, if anything: a schema, or a table.
+	let aclEditor = $state<PgAclEditor | undefined>(undefined)
+	/** The open access editor lists the data table's roles, which the roles drawer can change. */
+	export function refreshAcl() {
+		aclEditor?.refresh()
+	}
 	let aclDrawer = $state<{ datatable: string | undefined; target: AclTarget } | undefined>(
 		undefined
 	)
@@ -1466,7 +1472,7 @@
 <Portal>
 	<Drawer open={!!aclDrawer} size="900px" on:close={() => (aclDrawer = undefined)}>
 		<DrawerContent
-			title="Access — {aclLabel(aclDrawer?.target)}"
+			title="Access: {aclLabel(aclDrawer?.target)}"
 			on:close={() => (aclDrawer = undefined)}
 			tooltip="Who owns this, and what each role may do with it."
 		>
@@ -1474,7 +1480,18 @@
 				{@const dt = aclDrawer.datatable ?? currentDatatable}
 				{#if dt}
 					{#key `${dt}~${JSON.stringify(aclDrawer.target)}`}
-						<PgAclEditor {workspace} datatable={dt} target={aclDrawer.target} />
+						<PgAclEditor
+							bind:this={aclEditor}
+							{workspace}
+							datatable={dt}
+							target={aclDrawer.target}
+							manageRoles={onDatatableAction
+								? {
+										open: () => onDatatableAction?.(dt, 'roles'),
+										blocker: accessBlocker(dt, true)?.reason
+									}
+								: undefined}
+						/>
 					{/key}
 				{/if}
 			{/if}
diff --git a/frontend/src/lib/components/DBManagerDrawer.svelte b/frontend/src/lib/components/DBManagerDrawer.svelte
index bd016544b0..30fc93377d 100644
--- a/frontend/src/lib/components/DBManagerDrawer.svelte
+++ b/frontend/src/lib/components/DBManagerDrawer.svelte
@@ -311,6 +311,7 @@
 	function refreshRoles() {
 		datatables.refetch()
 		usableRoles.refetch()
+		dbManagerContent?.dbManager()?.refreshAcl()
 	}
 
 	async function handleExportSchema(explicitSource?: string) {
diff --git a/frontend/src/lib/components/DatatablePicker.svelte b/frontend/src/lib/components/DatatablePicker.svelte
index 53617acf36..17ad6f3361 100644
--- a/frontend/src/lib/components/DatatablePicker.svelte
+++ b/frontend/src/lib/components/DatatablePicker.svelte
@@ -17,6 +17,9 @@
 		selectInputClass?: string
 		class?: string
 		onClear?: () => void
+		/** Size the input to its content, like Path's folder picker. */
+		useContentEditable?: boolean
+		RightIcon?: any
 	}
 
 	let {
@@ -27,7 +30,9 @@
 		placeholder = undefined,
 		selectInputClass = '',
 		class: className = '',
-		onClear = undefined
+		onClear = undefined,
+		useContentEditable = false,
+		RightIcon = undefined
 	}: Props = $props()
 
 	let datatables = usePromise(() =>
@@ -47,6 +52,8 @@
 		{placeholder}
 		inputClass={selectInputClass}
 		{onClear}
+		{useContentEditable}
+		{RightIcon}
 	/>
 	{#if showSchemaExplorer && value && assetCanBeExplored({ kind: 'datatable', path: value })}
 		<ExploreAssetButton class="mt-1 w-fit" asset={{ kind: 'datatable', path: value }} />
diff --git a/frontend/src/lib/components/DevWorkspaceBadge.svelte b/frontend/src/lib/components/DevWorkspaceBadge.svelte
new file mode 100644
index 0000000000..e86e4593c8
--- /dev/null
+++ b/frontend/src/lib/components/DevWorkspaceBadge.svelte
@@ -0,0 +1,56 @@
+<!--
+@component
+The badge naming a dev workspace's environment, wherever one is shown.
+
+A fork that has a colour wears it: the badge is filled with that hue at the lightest shade white
+still reads on (`forkAccentStyle`), so a yellow workspace says "dev" in dark yellow rather than in
+a blue that belongs to no workspace in particular. A fork with no colour keeps whatever its host
+gave it — `fallbackColor` and `fallbackClass`, which is what every dev workspace looked like
+before a colour could be picked.
+-->
+<script lang="ts">
+	import { Badge } from '$lib/components/common'
+	import type { BadgeColor } from '$lib/components/common/badge/model'
+	import { devBadgeText } from '$lib/utils/devWorkspaceLabel'
+	import { forkAccentStyle } from '$lib/utils/forkColor'
+	import { twMerge } from 'tailwind-merge'
+
+	interface Props {
+		/** The workspace's `dev_workspace_label`; spelled the way `devBadgeText` spells it. Nullable
+		 *  because that is what the workspace rows carry. */
+		label?: string | null
+		/** The fork's own colour. Without one — or with an unparsable one — the badge falls back. */
+		color?: string | null
+		/** The badge's colour when the fork has none of its own. */
+		fallbackColor?: BadgeColor
+		/** Extra classes for that same case, for a host that tuned the uncoloured badge. */
+		fallbackClass?: string
+		/** Size and spacing, which the row around the badge decides either way. */
+		class?: string
+	}
+
+	let {
+		label,
+		color,
+		fallbackColor = 'dark-blue',
+		fallbackClass,
+		class: className
+	}: Props = $props()
+
+	// Set on the badge itself rather than read from an ancestor: a host that paints a coloured chip
+	// around it already defines these, and defining them again costs nothing and makes the badge
+	// work the same in a row that has no chip.
+	const accent = $derived(forkAccentStyle(color))
+</script>
+
+<Badge
+	color={fallbackColor}
+	small
+	style={accent}
+	class={twMerge(
+		accent
+			? 'bg-[color:var(--fork-accent-badge)] dark:bg-[color:var(--fork-accent-badge)] text-white dark:text-white'
+			: fallbackClass,
+		className
+	)}>{devBadgeText(label)}</Badge
+>
diff --git a/frontend/src/lib/components/DevWorkspaceSetting.svelte b/frontend/src/lib/components/DevWorkspaceSetting.svelte
index e148d90c22..ff9932fa87 100644
--- a/frontend/src/lib/components/DevWorkspaceSetting.svelte
+++ b/frontend/src/lib/components/DevWorkspaceSetting.svelte
@@ -1,7 +1,8 @@
 <script lang="ts">
 	import { workspaceStore, userWorkspaces, usersWorkspaceStore, superadmin } from '$lib/stores'
 	import { WorkspaceService, type ProtectionRuleset } from '$lib/gen'
-	import { Badge, Button } from '$lib/components/common'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
+	import { Button } from '$lib/components/common'
 	import Select from '$lib/components/select/Select.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import { sendUserToast } from '$lib/toast'
@@ -17,7 +18,6 @@
 	import { getUserExt } from '$lib/user'
 	import {
 		DEV_WORKSPACE_LABELS,
-		devBadgeText,
 		devLabelKey,
 		devLabelNoun,
 		type DevWorkspaceLabelKey
@@ -554,7 +554,11 @@
 			<b>{parentId}</b>. Promote changes from the home page banner or the Compare &amp; Deploy page.
 		</p>
 		<div class="text-2xs text-secondary">
-			Environment: <Badge color="indigo" small>{devBadgeText(currentLabel)}</Badge>
+			Environment: <DevWorkspaceBadge
+				label={currentLabel}
+				color={currentWs?.color}
+				fallbackColor="indigo"
+			/>
 			<span class="ml-1">
 				Set when the workspace is created or attached. Git sync deploys to the
 				<span class="font-mono">{currentLabel}</span> branch.
diff --git a/frontend/src/lib/components/DropdownV2Inner.svelte b/frontend/src/lib/components/DropdownV2Inner.svelte
index 31fd9426f5..70ed83398d 100644
--- a/frontend/src/lib/components/DropdownV2Inner.svelte
+++ b/frontend/src/lib/components/DropdownV2Inner.svelte
@@ -107,9 +107,19 @@
 				<DropdownSubmenuItem {item} {builders} {meltItem} close={close ?? (() => {})} />
 			{:else if item.disabled && item.tooltip}
 				<!-- Wrapper carries the native `title`; the disabled button's `pointer-events-none`
-				     lets the hover reach it so the user learns why the item is disabled. -->
-				<div title={item.tooltip} class="w-full">
-					{@render menuItem(item)}
+				     lets the hover reach it so the user learns why the item is disabled. The ⓘ sits
+				     outside the disabled button, the only place it can receive a hover. -->
+				<div class="relative w-full">
+					<div title={item.tooltip} class="w-full pr-6">
+						{@render menuItem(item)}
+					</div>
+					<div class="absolute right-3 top-1/2 -translate-y-1/2 flex">
+						<Tooltip>
+							{#snippet text()}
+								{item.tooltip}
+							{/snippet}
+						</Tooltip>
+					</div>
 				</div>
 			{:else}
 				{@render menuItem(item)}
diff --git a/frontend/src/lib/components/DucklakePicker.svelte b/frontend/src/lib/components/DucklakePicker.svelte
index 3a6f2bf739..d6ed4d0cdf 100644
--- a/frontend/src/lib/components/DucklakePicker.svelte
+++ b/frontend/src/lib/components/DucklakePicker.svelte
@@ -17,6 +17,9 @@
 		selectInputClass?: string
 		class?: string
 		onClear?: () => void
+		/** Size the input to its content, like Path's folder picker. */
+		useContentEditable?: boolean
+		RightIcon?: any
 	}
 
 	let {
@@ -27,7 +30,9 @@
 		placeholder = undefined,
 		selectInputClass = '',
 		class: className = '',
-		onClear = undefined
+		onClear = undefined,
+		useContentEditable = false,
+		RightIcon = undefined
 	}: Props = $props()
 
 	let ducklakes = usePromise(() =>
@@ -45,6 +50,8 @@
 		{placeholder}
 		inputClass={selectInputClass}
 		{onClear}
+		{useContentEditable}
+		{RightIcon}
 	/>
 	{#if showSchemaExplorer && value && assetCanBeExplored({ kind: 'ducklake', path: value })}
 		<ExploreAssetButton class="mt-1 w-fit" asset={{ kind: 'ducklake', path: value }} />
diff --git a/frontend/src/lib/components/Editor.svelte b/frontend/src/lib/components/Editor.svelte
index f9df8adcef..03bf5ce87e 100644
--- a/frontend/src/lib/components/Editor.svelte
+++ b/frontend/src/lib/components/Editor.svelte
@@ -1523,6 +1523,9 @@
 		} catch (e) {
 			console.log('error initializing services', e)
 		}
+		// Unmounted while the services loaded: the container is detached, and
+		// creating the editor on it throws.
+		if (destroyed || !divEl?.isConnected) return
 
 		// vscode.languages.registerDefinitionProvider('*', {
 		// 	provideDefinition(document, position, token) {
diff --git a/frontend/src/lib/components/EditorBar.svelte b/frontend/src/lib/components/EditorBar.svelte
index 81ef6c1c96..2db471e2c8 100644
--- a/frontend/src/lib/components/EditorBar.svelte
+++ b/frontend/src/lib/components/EditorBar.svelte
@@ -105,6 +105,7 @@
 			| 'powershell'
 			| 'bunnative'
 			| 'claudesandbox'
+			| 'pisandbox'
 			| 'wac_python'
 			| 'wac_typescript'
 			| 'ci_test_bun'
diff --git a/frontend/src/lib/components/EditorHeader.svelte b/frontend/src/lib/components/EditorHeader.svelte
index 25291fa5f0..a44568560c 100644
--- a/frontend/src/lib/components/EditorHeader.svelte
+++ b/frontend/src/lib/components/EditorHeader.svelte
@@ -1,10 +1,7 @@
 <script lang="ts">
-	import { Pencil } from 'lucide-svelte'
-	import { Alert, Button } from '$lib/components/common'
+	import { ChevronRight } from 'lucide-svelte'
 	import EditableInput from '$lib/components/common/EditableInput.svelte'
-	import Popover from '$lib/components/meltComponents/Popover.svelte'
-	import Path from '$lib/components/Path.svelte'
-	import Label from '$lib/components/Label.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
 	import {
 		dirKey,
 		KIND_LABEL_LOWER,
@@ -14,17 +11,7 @@
 		type WorkspaceItemKind
 	} from '$lib/components/workspacePicker'
 	import BreadcrumbSegment from '$lib/components/BreadcrumbSegment.svelte'
-	import { isOwner } from '$lib/utils'
-	import { userStore } from '$lib/stores'
-	import {
-		useOperatingUser,
-		useOperatingWorkspace
-	} from '$lib/components/operatingWorkspace.svelte'
-
-	const operatingWorkspace = useOperatingWorkspace()
-	const operatingUser = useOperatingUser()
-	const actingUser = $derived(operatingUser.current)
-
+	import { splitItemPath } from '$lib/components/breadcrumbPath'
 	interface Props {
 		summary?: string
 		path?: string
@@ -75,55 +62,17 @@
 		workspaceId
 	}: Props = $props()
 
-	let pathPopoverOpen = $state(false)
-	/** Snapshot of `path` taken when the pen popover opens; cleared on close.
-	 * While set, the breadcrumb derives from it instead of `path` so the pen
-	 * anchor doesn't reflow as the user types in the popover (which would drag
-	 * the popover with it via floating-ui's auto-update). */
+	/** Held by the pen popover while it is open, so the trail below — and the pen anchored to its
+	 * end — does not reflow as the user types. */
 	let snapshotPath = $state<string | undefined>(undefined)
 
-	function setPathPopoverOpen(open: boolean) {
-		pathPopoverOpen = open
-		// Only snapshot when there's a path to freeze. New flows / scripts open
-		// the popover with `path === ''` and rely on `Path.reset()` to seed a
-		// path; if we snapshot the empty value the breadcrumb stays blank for
-		// the whole popover lifetime. Leaving `snapshotPath` undefined lets
-		// `displayPath` track the live seeded path instead.
-		snapshotPath = open && path ? path : undefined
-	}
-
 	// Path segments. e.g. "f/demo/weather_report" → scope "f/demo", slug "weather_report".
 	// `snapshotPath` keeps the breadcrumb frozen while the pen popover is open
 	// so the trigger doesn't drift mid-edit. Outside of that, the breadcrumb
 	// follows the live `path` — coherent with the picker because we inject a
 	// virtual current-item entry at that same live path (see `currentItem`).
 	let displayPath = $derived(snapshotPath ?? path ?? '')
-	/** Breakdown for breadcrumb rendering. Top-level dirs (scopes) come first
-	 * — `f/<folder>` or `u/<user>` — then any number of subfolders, then the
-	 * item name. Each dir entry's `fullPath` is the cumulative path up to
-	 * that level, used to key the picker's `initialOpen` / `initialHighlight`. */
-	let segments = $derived.by(() => {
-		const parts = displayPath.split('/')
-		if (parts.length < 3) return null
-		const scope = parts.slice(0, 2).join('/')
-		const slug = parts.slice(2)
-		const dirs: { name: string; fullPath: string }[] = []
-		// Top-level scope is a dir.
-		dirs.push({ name: scope, fullPath: scope })
-		// Intermediate slug parts (everything except the last one).
-		let acc = scope
-		for (let i = 0; i < slug.length - 1; i++) {
-			acc = `${acc}/${slug[i]}`
-			dirs.push({ name: slug[i], fullPath: acc })
-		}
-		const leaf = { name: slug[slug.length - 1], fullPath: displayPath }
-		return { dirs, leaf }
-	})
-
-	// Treat an empty path as ownable so the pen popover lets a user pick the
-	// path for a brand-new item. `Path.reset()` then synthesizes a default
-	// under their own user/folder scope.
-	let own = $derived(!path || isOwner(path, actingUser, $operatingWorkspace))
+	let segments = $derived(splitItemPath(displayPath) ?? null)
 
 	// Virtual entry for the picker: surfaces the currently-edited item at its
 	// live path (which may differ from `savedPath` mid-rename, so the picker
@@ -145,7 +94,7 @@
 	}
 </script>
 
-<div class="inline-block max-w-full align-top group px-2 py-0.5 leading-tight">
+<div class="max-w-full group px-2 py-0.5 leading-tight inline-block align-top">
 	<!-- Path row -->
 	{#if !hidePath}
 		<div class="flex items-center max-w-full text-2xs text-secondary font-mono">
@@ -162,9 +111,9 @@
 				{#if segments}
 					{#each segments.dirs as dir, i (dir.fullPath)}
 						{@const dKey = dirKey('all', dir.fullPath)}
+						<ChevronRight size={10} class="shrink-0" />
 						<BreadcrumbSegment
 							label={dir.name}
-							withChevron
 							extraClass={i === 0 ? 'gap-0.5 min-w-0 max-w-[40%]' : 'gap-0.5 min-w-0'}
 							initialScope={i === 0
 								? { kind: 'all' }
@@ -175,11 +124,13 @@
 							onPick={handlePickerSelect}
 						/>
 					{/each}
+				{/if}
+				{#if segments?.leaf}
 					{@const leafKey = leafKeyFor(kind, segments.leaf.fullPath)}
 					{@const leafParent = segments.dirs[segments.dirs.length - 1]?.fullPath}
+					<ChevronRight size={10} class="shrink-0" />
 					<BreadcrumbSegment
 						label={segments.leaf.name}
-						withChevron
 						extraClass="gap-0.5 min-w-0"
 						initialScope={leafParent ? { kind: 'all', dir: leafParent } : { kind: 'all' }}
 						initialHighlight={leafKey}
@@ -191,65 +142,21 @@
 				{/if}
 			</nav>
 
-			<!-- Pen → path-edit popover. Skipped entirely when path editing is
-		     disabled so the user doesn't see an inert button. -->
+			<!-- Skipped entirely when path editing is disabled so the user doesn't see an inert
+			     button. -->
 			{#if pathEditable}
-				<Popover
-					placement="bottom-start"
-					contentClasses="p-4"
-					usePointerDownOutside
-					excludeSelectors=".drawer"
-					disableFocusTrap
-					closeOnOtherPopoverOpen
-					bind:isOpen={() => pathPopoverOpen, setPathPopoverOpen}
-				>
-					{#snippet trigger()}
-						<Button
-							variant="subtle"
-							unifiedSize="xs"
-							iconOnly
-							startIcon={{ icon: Pencil }}
-							title="Edit path"
-							aria-label="Edit path"
-							btnClasses={penVisibility === 'hover' && !pathPopoverOpen
-								? 'opacity-0 transition-opacity group-hover:opacity-100 focus-visible:opacity-100'
-								: ''}
-						/>
-					{/snippet}
-					{#snippet content()}
-						<div class="flex flex-col gap-6 w-[480px]">
-							{#if own}
-								<Path
-									autofocus
-									bind:path
-									initialPath={snapshotPath ?? path ?? ''}
-									namePlaceholder={kind}
-									{kind}
-									size="sm"
-									drawerOffset={4000}
-									workspaceOverride={workspaceId}
-								/>
-								{#if savedPath && path && path !== savedPath}
-									<Alert
-										type="info"
-										size="xs"
-										title="Deploy the {kind} to make the path change effective."
-									/>
-								{/if}
-								{#if onBehalfOfEmail}
-									<Alert type="info" title="Run on behalf of" size="xs">
-										This flow will be redeployed on behalf of you ({$userStore?.email}) instead of {onBehalfOfEmail}
-									</Alert>
-								{/if}
-							{:else}
-								<Label label="Path">
-									<span class="text-xs font-mono text-secondary">{path}</span>
-									<p class="text-2xs text-tertiary mt-1">Only the owner can change the path</p>
-								</Label>
-							{/if}
-						</div>
-					{/snippet}
-				</Popover>
+				<!-- Path only: this bar carries its own summary field below, and `hidePath` would take
+				     the pen with it, leaving a condensed pane no way to name the item. -->
+				<PathEditPopover
+					bind:path
+					bind:snapshotPath
+					summaryEditable={false}
+					{savedPath}
+					{kind}
+					{workspaceId}
+					{onBehalfOfEmail}
+					{penVisibility}
+				/>
 			{/if}
 		</div>
 	{/if}
diff --git a/frontend/src/lib/components/FilterSearchbar.svelte b/frontend/src/lib/components/FilterSearchbar.svelte
index b4bc4471a2..0a65701b06 100644
--- a/frontend/src/lib/components/FilterSearchbar.svelte
+++ b/frontend/src/lib/components/FilterSearchbar.svelte
@@ -303,7 +303,12 @@
 
 <script lang="ts">
 	import { twMerge } from 'tailwind-merge'
-	import { inputBaseClass, inputBorderClass, inputSizeClasses } from './text_input/TextInput.svelte'
+	import {
+		inputBaseClass,
+		inputBorderClass,
+		inputLeadingClasses,
+		inputSizeClasses
+	} from './text_input/TextInput.svelte'
 	import { MinusIcon, SearchIcon } from 'lucide-svelte'
 	import { assignObjInPlace, clone } from '$lib/utils'
 	import GenericDropdown from './select/GenericDropdown.svelte'
@@ -338,7 +343,7 @@
 		hideDropdownOnFreeText?: boolean
 		// Notified whenever the dropdown's effective visibility changes
 		onDropdownVisibleChange?: (visible: boolean) => void
-		size?: 'md' | 'lg'
+		size?: 'sm' | 'md' | 'lg'
 		// On the right the icon gives way to the clear button once there is text; on the left
 		// it stays put.
 		searchIconPosition?: 'left' | 'right'
@@ -747,7 +752,11 @@
 			'overflow-x-auto !pr-24 bg-surface-input outline-none scrollbar-hidden text-nowrap flex-1 mr-2 mt-0.5',
 			inputBaseClass,
 			inputSizeClasses[size],
-			// The editable's fixed top padding centres the text at md height.
+			// The editable's own 2px top margin is what centres the text at md height, where its box
+			// is shorter than the row. At sm the two are the same height, so that margin only pushes
+			// the text below centre: drop it and take the leading the shared table defines, which is
+			// the row's height less its padding.
+			size === 'sm' && twMerge('!mt-0', inputLeadingClasses.sm),
 			size === 'lg' && '!pt-[0.7rem]',
 			searchIconPosition === 'left' && '!pl-1.5'
 		)}
diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index 7d92e08484..57cd8b2953 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -28,7 +28,8 @@
 		userPathPrefix,
 		type Item,
 		type StateStore,
-		type Value
+		type Value,
+		emptyString
 	} from '$lib/utils'
 	import { sendUserToast } from '$lib/toast'
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
@@ -36,7 +37,10 @@
 	import DeployOverrideConfirmationModal from '$lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte'
 	import AIChangesWarningModal from '$lib/components/copilot/chat/flow/AIChangesWarningModal.svelte'
 
-	import { getContext, onDestroy, setContext, untrack } from 'svelte'
+	import { getContext, onDestroy, setContext, untrack, type Snippet } from 'svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
 	import { writable } from 'svelte/store'
 	import CenteredPage from './CenteredPage.svelte'
 	import { Button } from './common'
@@ -158,12 +162,16 @@
 		othersDraftsCount = 0,
 		onOpenOthersDrafts,
 		onTestJob,
-		condensedHeader = false
+		condensedHeader = false,
+		/** True for the route's own editor: its top bar becomes the page header. */
+		ownsPageHeader = false
 	}: FlowBuilderProps = $props()
 
 	// Top-bar button size + bar height. Condensed (session preview) uses the
 	// smallest well-supported unified size (`sm`) so the bar is thinner.
-	const headerBtnSize = $derived(condensedHeader ? 'sm' : 'md')
+	// In the page header the buttons ride a 40px band, the same size the condensed session-pane
+	// header uses.
+	const headerBtnSize = $derived(condensedHeader || ownsPageHeader ? 'sm' : 'md')
 
 	// The workspace this editor operates on: deploy, save-draft, trigger loading
 	// and the AutosaveIndicator all target it. Falls back to the global store, so
@@ -216,8 +224,24 @@
 	// Top-bar responsive collapse. Measured via bind:clientWidth — we can't
 	// rely on viewport `md:` because the editor lives inside other panes
 	// (session pane, drawer, etc.) where the viewport stays wide.
+	/** Held by the rename popover while it is open; the band's trail reads it so the path does not
+	 *  reflow under the pointer as the user types. */
+	let pathSnapshot = $state<string | undefined>(undefined)
+
 	let topbarWidth = $state(0)
-	const compactTopbar = $derived(topbarWidth > 0 && topbarWidth < 720)
+	// In the page header the buttons share the row with the breadcrumb, so they collapse sooner:
+	// the trail and the summary take ~560px before either truncates, and the full group — the
+	// dropdown, Diff, the preview trio and Deploy — is ~610px.
+	const compactBelow = $derived(ownsPageHeader ? 1200 : 720)
+	const compactTopbar = $derived.by(() => {
+		const w = ownsPageHeader ? pageHeader.barWidth : topbarWidth
+		return w > 0 && w < compactBelow
+	})
+	// A phone's bar holds the trail and Deploy: the diff joins the menu and the preview buttons
+	// stand down, since there is no room to run a flow beside its own name.
+	const phoneTopbar = $derived(
+		ownsPageHeader && pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR
+	)
 
 	const diffEnabled = $derived(customUi?.topBar?.diff != false)
 	// Nothing to compare against until a deployed version exists.
@@ -228,7 +252,7 @@
 	// The narrow bar (sessions) and the width-collapsed one have no room for a Diff
 	// button, so it moves into the menu ahead of Deployment History instead of
 	// dropping out of reach.
-	const diffInMenu = $derived(condensedHeader || compactTopbar)
+	const diffInMenu = $derived(condensedHeader || compactTopbar || phoneTopbar)
 	const diffMenuItems: Item[] = $derived(
 		diffEnabled && diffInMenu
 			? [
@@ -336,7 +360,7 @@
 			savedValue: savedFlow,
 			modifiedValue: {
 				...flowStore.val,
-				// `$pathStore` is the live-edited path (the pen popover binds it).
+				// `$pathStore` is the live-edited path (the rename popover binds it).
 				// `flowStore.val.path` doesn't track those edits, so without this the
 				// rename wouldn't show up in the diff and the unsaved-changes warning
 				// wouldn't fire when leaving with a pending rename.
@@ -1278,6 +1302,16 @@
 
 	setContext('FlowCopilotContext', flowCopilotContext)
 
+	// The header's action buttons render under the page header, not under this component, so the
+	// contexts they look up have to travel with them. Read back here, after every setContext above.
+	const headerContexts = new Map<any, any>([
+		['FlowEditorContext', getContext('FlowEditorContext')],
+		['TriggerContext', getContext('TriggerContext')],
+		['FlowGraphAssetContext', getContext('FlowGraphAssetContext')],
+		['FlowCopilotContext', flowCopilotContext],
+		['customUi', customUi]
+	])
+
 	let renderCount = $state(0)
 
 	let jsonViewerDrawer: Drawer | undefined = $state(undefined)
@@ -1537,81 +1571,221 @@
 		<FlowEditorDrawer bind:this={$flowEditorDrawer} />
 
 		<div bind:this={flowBuilderRoot} class="flex flex-col h-full">
-			<!-- Nav between steps-->
-			<div
-				bind:clientWidth={topbarWidth}
-				class="justify-between flex flex-row items-center pl-2 pr-4 space-x-4 scrollbar-hidden overflow-x-auto h-full relative {condensedHeader
-					? 'max-h-9'
-					: 'max-h-12'}"
-			>
-				<div class="flex flex-row items-center gap-2 min-w-0">
-					{#if customUi?.topBar?.path != false}
-						<div class="min-w-0 overflow-hidden">
-							<EditorHeader
-								bind:summary={flowStore.val.summary}
-								bind:path={$pathStore}
-								savedPath={initialPath}
-								onBehalfOfEmail={$savedOnBehalfOfEmail}
-								summaryEditable={customUi?.topBar?.editableSummary != false}
-								pathEditable={customUi?.topBar?.editablePath != false}
-								hidePath={condensedHeader}
-								workspaceId={autosaveWorkspace}
-								onNavigate={(item) => onNavigate?.(item)}
+			{#if ownsPageHeader}
+				<!-- The editor's own top bar is the page header on this route: its breadcrumb and
+				     summary are the header's, and its buttons are the header's actions. -->
+				<!-- `separator="none"`: the canvas right below the bar draws its own top line, and the
+				     bar's edge would be a second one on top of it. -->
+				<PageHeaderContent
+					item={{
+						// Frozen while the rename popover is open so the trail holds still as the user types.
+						kind: 'flow',
+						path: pathSnapshot ?? $pathStore,
+						summaryContent: flowSummary,
+						// Gated like the summary's own editor: a host that allows neither field keeps the
+						// band's segment, which copies the path.
+						pathTrigger:
+							customUi?.topBar?.editablePath != false ||
+							customUi?.topBar?.editableSummary != false
+								? flowPathTrigger
+								: undefined
+					}}
+					actions={flowHeaderActions}
+					contexts={headerContexts}
+					separator="none"
+				/>
+			{:else}
+				<!-- Nav between steps-->
+				<div
+					bind:clientWidth={topbarWidth}
+					class="justify-between flex flex-row items-center pl-2 pr-4 space-x-4 scrollbar-hidden overflow-x-auto h-full relative {condensedHeader
+						? 'max-h-9'
+						: 'max-h-12'}"
+				>
+					<div class="flex flex-row items-center gap-2 min-w-0">
+						{#if customUi?.topBar?.path != false}
+							<div class="min-w-0 overflow-hidden">
+								<EditorHeader
+									bind:summary={flowStore.val.summary}
+									bind:path={$pathStore}
+									savedPath={initialPath}
+									onBehalfOfEmail={$savedOnBehalfOfEmail}
+									summaryEditable={customUi?.topBar?.editableSummary != false}
+									pathEditable={customUi?.topBar?.editablePath != false}
+									hidePath={condensedHeader}
+									workspaceId={autosaveWorkspace}
+									onNavigate={(item) => onNavigate?.(item)}
+								/>
+							</div>
+						{/if}
+						{#if opWorkspace && indicatorPath !== undefined}
+							<AutosaveIndicator
+								workspace={opWorkspace}
+								itemKind="flow"
+								path={indicatorPath}
+								draftOnly={newFlow}
+								{onResetToDeployed}
+								{loadedFromDraft}
+								{othersDraftsCount}
+								{onOpenOthersDrafts}
 							/>
-						</div>
-					{/if}
-					{#if opWorkspace && indicatorPath !== undefined}
-						<AutosaveIndicator
-							workspace={opWorkspace}
-							itemKind="flow"
-							path={indicatorPath}
-							draftOnly={newFlow}
-							{onResetToDeployed}
-							{loadedFromDraft}
-							{othersDraftsCount}
-							{onOpenOthersDrafts}
-						/>
-					{/if}
-				</div>
-				<div class="flex flex-row gap-2 items-center shrink-0">
-					{#if $enterpriseLicense && !newFlow && !inSessionPane}
-						<Awareness />
-					{/if}
-					<Dropdown items={getMoreItems} size={headerBtnSize} fixedHeight={!condensedHeader} />
-					{#if diffEnabled && !diffInMenu}
-						<!-- A disabled <button> fires no pointer events, so a title/tooltip on
+						{/if}
+					</div>
+					<div class="flex flex-row gap-2 items-center shrink-0">
+						{#if $enterpriseLicense && !newFlow && !inSessionPane}
+							<Awareness />
+						{/if}
+						<Dropdown items={getMoreItems} size={headerBtnSize} fixedHeight={!condensedHeader} />
+						{#if diffEnabled && !diffInMenu}
+							<!-- A disabled <button> fires no pointer events, so a title/tooltip on
 						     it never shows on hover. pointer-events-none on the button lets the
 						     hover reach this titled wrapper instead. -->
-						<div title={diffTitle} class={diffDisabled ? 'flex cursor-not-allowed' : 'flex'}>
-							<Button
-								variant="default"
-								unifiedSize={headerBtnSize}
-								on:click={() => openDiffDrawer()}
-								disabled={diffDisabled}
-								btnClasses={diffDisabled ? 'pointer-events-none' : undefined}
-								title={diffTitle}
-								startIcon={{ icon: DiffIcon }}
-							>
-								Diff
-							</Button>
-						</div>
-					{/if}
-					{#if !compactTopbar}
-						{@render previewButtons()}
-					{/if}
+							<div title={diffTitle} class={diffDisabled ? 'flex cursor-not-allowed' : 'flex'}>
+								<Button
+									variant="default"
+									unifiedSize={headerBtnSize}
+									on:click={() => openDiffDrawer()}
+									disabled={diffDisabled}
+									btnClasses={diffDisabled ? 'pointer-events-none' : undefined}
+									title={diffTitle}
+									startIcon={{ icon: DiffIcon }}
+								>
+									Diff
+								</Button>
+							</div>
+						{/if}
+						{#if !compactTopbar}
+							{@render previewButtons()}
+						{/if}
 
-					<DeployButton
-						on:save={async ({ detail }) => await handleSaveFlow(detail)}
-						{loading}
-						{loadingSave}
-						unifiedSize={headerBtnSize}
-						{dropdownItems}
-					/>
+						<DeployButton
+							on:save={async ({ detail }) => await handleSaveFlow(detail)}
+							{loading}
+							{loadingSave}
+							unifiedSize={headerBtnSize}
+							{dropdownItems}
+						/>
+					</div>
 				</div>
-			</div>
-			<!-- Rendered either inline in the top bar (wide) or as a graph overlay
-			     (compactTopbar). Crossing the 720px threshold remounts
-			     FlowPreviewButtons; any open preview state will reset. -->
+			{/if}
+
+			<!-- The summary's editor again, hung off the band's path segment so it opens under the
+			     path, with the cursor in the path field. `bind:` cannot be spread, so the slots are
+			     written out twice; both instances bind the same ones and only one is ever open. -->
+			{#snippet flowPathTrigger(pathLabel: Snippet, triggerClass: string)}
+				<!-- Gated the way the script editor gates its own, `{:else}` included: this renders from
+				     the band's tree, which outlives what it reads here by a flush, and the band has
+				     already given up its own segment by the time this decides. -->
+				{#if flowStore?.val}
+					<PathEditPopover
+						label={pathLabel}
+						{triggerClass}
+						focusField="path"
+						bind:summary={flowStore.val.summary}
+						summaryEditable={customUi?.topBar?.editableSummary != false}
+						pathEditable={customUi?.topBar?.editablePath != false}
+						bind:path={$pathStore}
+						bind:snapshotPath={pathSnapshot}
+						savedPath={initialPath}
+						kind="flow"
+						onBehalfOfEmail={$savedOnBehalfOfEmail}
+						workspaceId={autosaveWorkspace}
+					/>
+				{:else}
+					<span class={triggerClass}>{@render pathLabel()}</span>
+				{/if}
+			{/snippet}
+
+			{#snippet flowSummary()}
+				<!-- Not edited in place: clicking the name opens the summary and the path together, so
+				     the band reads as a name rather than a form. `title` for one it truncates. -->
+				<div class="flex items-center gap-1 min-w-0">
+					{#snippet summaryText()}
+						<span
+							class="min-w-0 truncate text-xs {emptyString(flowStore.val.summary)
+								? 'text-tertiary italic font-normal'
+								: 'font-medium text-emphasis'}"
+							title={flowStore.val.summary}
+							>{emptyString(flowStore.val.summary)
+								? 'Add a summary...'
+								: flowStore.val.summary}</span
+						>
+					{/snippet}
+					{#if customUi?.topBar?.editablePath != false || customUi?.topBar?.editableSummary != false}
+						<PathEditPopover
+							label={summaryText}
+							bind:summary={flowStore.val.summary}
+							summaryEditable={customUi?.topBar?.editableSummary != false}
+							pathEditable={customUi?.topBar?.editablePath != false}
+							bind:path={$pathStore}
+							bind:snapshotPath={pathSnapshot}
+							savedPath={initialPath}
+							kind="flow"
+							onBehalfOfEmail={$savedOnBehalfOfEmail}
+							workspaceId={autosaveWorkspace}
+						/>
+					{:else}
+						{@render summaryText()}
+					{/if}
+				</div>
+			{/snippet}
+
+			{#snippet flowHeaderActions()}
+				<!-- Saving state, the autosave toggle and other people's drafts: the editor's own
+					     bar carries them beside the path, so the header has to carry them when it owns
+					     the bar — without them a full-page editor saves with no word either way. -->
+				{#if opWorkspace && indicatorPath !== undefined}
+					<AutosaveIndicator
+						workspace={opWorkspace}
+						itemKind="flow"
+						path={indicatorPath}
+						draftOnly={newFlow}
+						{onResetToDeployed}
+						{loadedFromDraft}
+						{othersDraftsCount}
+						{onOpenOthersDrafts}
+					/>
+				{/if}
+				{#if $enterpriseLicense && !newFlow && !inSessionPane}
+					<Awareness />
+				{/if}
+				<Dropdown items={getMoreItems} size={headerBtnSize} fixedHeight={!condensedHeader} />
+				{#if diffEnabled && !diffInMenu}
+					<!-- A disabled <button> fires no pointer events, so a title/tooltip on
+						     it never shows on hover. pointer-events-none on the button lets the
+						     hover reach this titled wrapper instead. -->
+					<div title={diffTitle} class={diffDisabled ? 'flex cursor-not-allowed' : 'flex'}>
+						<Button
+							variant="default"
+							unifiedSize={headerBtnSize}
+							on:click={() => openDiffDrawer()}
+							disabled={diffDisabled}
+							btnClasses={diffDisabled ? 'pointer-events-none' : undefined}
+							title={diffTitle}
+							startIcon={{ icon: DiffIcon }}
+						>
+							Diff
+						</Button>
+					</div>
+				{/if}
+				{#if !compactTopbar && !phoneTopbar}
+					{@render previewButtons()}
+				{/if}
+
+				<DeployButton
+					on:save={async ({ detail }) => await handleSaveFlow(detail)}
+					{loading}
+					{loadingSave}
+					unifiedSize={headerBtnSize}
+					{dropdownItems}
+				/>
+			{/snippet}
+
+			<!-- Rendered either inline in the top bar (wide) or as a graph overlay. The two
+			     conditions are exact complements: testing the flow is reachable at every width,
+			     and FlowPreviewButtons — which owns the preview state and the handles the graph
+			     calls into — is mounted exactly once. Crossing a threshold remounts it, so any
+			     open preview resets. -->
 			{#snippet previewButtons()}
 				<FlowPreviewButtons
 					{suspendStatus}
@@ -1641,7 +1815,7 @@
 			{#if flowStateStore.val}
 				<FlowEditor
 					bind:this={flowEditor}
-					graphOverlay={compactTopbar ? previewButtons : undefined}
+					graphOverlay={compactTopbar || phoneTopbar ? previewButtons : undefined}
 					{disabledFlowInputs}
 					disableAi={disableAi || customUi?.stepInputs?.ai == false}
 					disableSettings={customUi?.settingsPanel === false}
diff --git a/frontend/src/lib/components/FlowStatusViewerInner.svelte b/frontend/src/lib/components/FlowStatusViewerInner.svelte
index 1d56c20b38..638956add2 100644
--- a/frontend/src/lib/components/FlowStatusViewerInner.svelte
+++ b/frontend/src/lib/components/FlowStatusViewerInner.svelte
@@ -69,6 +69,7 @@
 		retainLinkedToolsScope
 	} from './flows/linkedAgentToolsStore.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { AGENT_STEP_ID, agentStepLabel } from './flows/conversations/agentEditorChat'
 
 	const operatingWorkspace = useOperatingWorkspace()
 
@@ -1238,6 +1239,8 @@
 		id: string
 		type: FlowModuleValue['type']
 		suspend?: boolean
+		/** Shown in place of the id. */
+		label?: string
 	}
 
 	function allModulesForTimeline(
@@ -1250,7 +1253,8 @@
 				({
 					id: x.id,
 					type: x.value.type,
-					suspend: x.suspend != undefined
+					suspend: x.suspend != undefined,
+					label: x.id === AGENT_STEP_ID ? agentStepLabel(job?.script_path) : undefined
 				}) as FlowModuleForTimeline,
 			{
 				skipToolNodes: true
diff --git a/frontend/src/lib/components/FlowTimeline.svelte b/frontend/src/lib/components/FlowTimeline.svelte
index 4ed13c1df1..640c8728ce 100644
--- a/frontend/src/lib/components/FlowTimeline.svelte
+++ b/frontend/src/lib/components/FlowTimeline.svelte
@@ -179,12 +179,12 @@
 				/>
 			</div>
 		{/if}
-		{#each flowModules as { id: k, type: typ, suspend: isSuspend } (k)}
+		{#each flowModules as { id: k, type: typ, suspend: isSuspend, label } (k)}
 			{@const subItems = items?.[k]?.filter((x) => x.created_at && x.started_at)}
 			<div class="relative px-3 py-1.5">
 				<div class="flex items-center justify-between mb-0.5">
 					<div class="text-xs font-medium"
-						>{k.startsWith('subflow:') ? k.substring(8) : k}
+						>{label ?? (k.startsWith('subflow:') ? k.substring(8) : k)}
 						{#if localModuleStates[k]?.selectedForloop && (typ == 'forloopflow' || typ == 'whileloopflow')}
 							<span class="text-xs font-mono font-medium inline-flex items-center -my-2">
 								<button onclick={(e) => e.stopPropagation()}>
diff --git a/frontend/src/lib/components/ForkWorkspaceBanner.svelte b/frontend/src/lib/components/ForkWorkspaceBanner.svelte
index 940c579fd7..11779afb11 100644
--- a/frontend/src/lib/components/ForkWorkspaceBanner.svelte
+++ b/frontend/src/lib/components/ForkWorkspaceBanner.svelte
@@ -1,14 +1,16 @@
 <script lang="ts">
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
+	import { Badge } from './common'
+	import { AlertTriangle, ArrowDown, ArrowUp, Pencil } from 'lucide-svelte'
 	import { workspaceStore, userWorkspaces, userStore, type UserExt } from '$lib/stores'
-	import { ScriptService } from '$lib/gen'
 	import type { WorkspaceComparison } from '$lib/gen'
 	import { fetchWorkspaceComparison } from '$lib/workspaceComparison'
 	import { Button } from './common'
-	import { AlertTriangle, GitFork, CircleCheck, CircleX, Loader2 } from 'lucide-svelte'
 	import { goto } from '$app/navigation'
 	import { onMount, untrack } from 'svelte'
 	import { useWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
-	import { childWorkspaceNoun, devLabelWord } from '$lib/utils/devWorkspaceLabel'
+	import { childWorkspaceNoun } from '$lib/utils/devWorkspaceLabel'
 	import { diffActionableInDirection } from '$lib/utils_workspace_deploy'
 
 	let loading = $state(false)
@@ -20,12 +22,10 @@
 
 	let currentWorkspaceData = $derived($userWorkspaces.find((w) => w.id === $workspaceStore))
 	let parentWorkspaceId = $derived(currentWorkspaceData?.parent_workspace_id)
-	let parentWorkspaceData = $derived($userWorkspaces.find((w) => w.id === parentWorkspaceId))
 	// Detect fork/dev workspaces by their parent link, not the `wm-fork-` id prefix (dev
 	// workspaces have an ordinary, prefix-less id). Keying on the parent (rather than the
 	// prefix) also avoids a parentless "Fork of ()" banner when the linkage is dropped.
 	let isFork = $derived(parentWorkspaceId != null)
-	let isDevWorkspace = $derived(currentWorkspaceData?.is_dev_workspace ?? false)
 	let currentNoun = $derived(childWorkspaceNoun(currentWorkspaceData))
 	// Operators run scripts and flows, they never deploy a fork, so the banner and
 	// its CTA are noise for them. Gates the fetches too, not just the markup: the
@@ -57,6 +57,11 @@
 	}
 	const hasAnswer = $derived(isAnswerable(comparison, loading))
 
+	/** Bar width from which each badge says what it counts. Below it they keep the icon and the
+	 *  number, which is the part a reader scans for; the tooltip names them either way. */
+	const BAR_FITS_COUNT_LABELS = 1280
+	const compactCounts = $derived(pageHeader.barWidth < BAR_FITS_COUNT_LABELS)
+
 	// Fork is fully in sync with its parent (comparison ran, no ahead/behind diffs).
 	function isUpToDate(c: WorkspaceComparison | undefined): boolean {
 		return !!c && !c.skipped_comparison && c.summary.total_diffs === 0
@@ -67,14 +72,12 @@
 	let showDraftsOnly = $derived(upToDate && draftCount > 0)
 
 	// Leaving for a workspace with no comparison of its own has to invalidate whatever
-	// is in flight too, or that response lands as this one's answer — and its CI counts
-	// would be fetched for paths this workspace may not even have.
+	// is in flight too, or that response lands as this one's answer.
 	function dropComparison() {
 		requestSeq++
 		comparison = undefined
 		comparisonFor = undefined
 		loading = false
-		resetCiTestSummary()
 	}
 
 	// `isNotOperator` is a dependency of its own: it only turns true once this
@@ -113,7 +116,6 @@
 		if (comparisonFor !== ws) {
 			comparison = undefined
 			comparisonFor = undefined
-			resetCiTestSummary()
 		}
 		const seq = ++requestSeq
 		loading = true
@@ -142,6 +144,18 @@
 
 	// Opens the direction the button offers, so the label and the list agree: a fork
 	// with nothing to deploy lands on the update side, not on an empty deploy list.
+	/** The compare page opened on one direction, for a badge that counts exactly that. The button
+	 *  beside them still chooses on the reader's behalf; a badge means the one thing it names. */
+	function openCompareDir(dir: 'deploy_to' | 'update') {
+		if (!parentWorkspaceId || !$workspaceStore) return
+		goto(
+			'/forks/compare?workspace_id=' +
+				encodeURIComponent($workspaceStore) +
+				(dir === 'update' ? '&dir=update' : ''),
+			{ replaceState: true }
+		)
+	}
+
 	function openComparisonDrawer() {
 		if (parentWorkspaceId && $workspaceStore) {
 			const dir = hasAnswer && changesAhead === 0 ? '&dir=update' : ''
@@ -159,68 +173,6 @@
 		}
 	}
 
-	let ciTestPassing = $state(0)
-	let ciTestFailing = $state(0)
-	let ciTestRunning = $state(0)
-	let ciTestTotal = $state(0)
-
-	// These describe the rows of one comparison, so they are dropped with it.
-	function resetCiTestSummary() {
-		ciTestPassing = 0
-		ciTestFailing = 0
-		ciTestRunning = 0
-		ciTestTotal = 0
-	}
-
-	async function fetchCiTestSummary() {
-		if (!$workspaceStore || !comparison?.diffs) return
-		const items = comparison.diffs
-			.filter((d) => d.kind === 'script' || d.kind === 'flow' || d.kind === 'resource')
-			.map((d) => ({ path: d.path, kind: d.kind as 'script' | 'flow' | 'resource' }))
-		if (items.length === 0) return
-		// Counted for the comparison current at call time — the poll below outlives a
-		// fork switch, and a slow batch for the fork we left would repaint this one's.
-		const seq = requestSeq
-		try {
-			const batch = await ScriptService.getCiTestResultsBatch({
-				workspace: $workspaceStore,
-				requestBody: { items }
-			})
-			if (seq !== requestSeq) return
-			let passing = 0
-			let failing = 0
-			let running = 0
-			let total = 0
-			for (const results of Object.values(batch)) {
-				for (const r of results) {
-					total++
-					if (r.status === 'success') passing++
-					else if (r.status === 'failure' || r.status === 'canceled') failing++
-					else if (r.status === 'running' || (r.job_id && !r.status)) running++
-				}
-			}
-			ciTestPassing = passing
-			ciTestFailing = failing
-			ciTestRunning = running
-			ciTestTotal = total
-		} catch (e) {
-			console.error('Failed to fetch CI test summary:', e)
-		}
-	}
-
-	$effect(() => {
-		if (comparison && comparison.summary.total_diffs > 0) {
-			fetchCiTestSummary()
-		}
-	})
-
-	// Poll while any CI test is still running
-	$effect(() => {
-		if (ciTestRunning <= 0) return
-		const interval = setInterval(fetchCiTestSummary, 3000)
-		return () => clearInterval(interval)
-	})
-
 	// Counted with the compare page's own predicate so the banner never advertises a
 	// direction whose list is empty: the `ahead`/`behind` sums in the summary include
 	// rows a direction does not carry, and miss a parent-only row that the update
@@ -246,191 +198,113 @@
 </script>
 
 {#if showBanner}
-	<!-- Side padding mirrors the page content container below, so the banner
-	     stays aligned with it instead of bleeding to the viewport edges. -->
-	<div class="w-full text-xs max-w-7xl mx-auto px-4 sm:px-8 pt-2">
-		<div class="bg-blue-50 dark:bg-blue-900 rounded-md px-4 py-2">
-			<!-- The summary wraps inside its own column while the CTA keeps its width and
-			     stays on the first line: laid out as one non-wrapping row, the summary is
-			     long enough on a laptop-width viewport to push the button out of the
-			     banner instead of getting shorter. -->
-			<div class="flex items-center justify-between gap-x-3">
-				<div class="flex items-center flex-wrap gap-x-3 gap-y-1 min-w-0">
-					<GitFork class="w-4 h-4 text-accent shrink-0" />
-					<div class="text-sm min-w-0">
-						<span class="font-medium text-blue-900 dark:text-blue-100">
-							{isDevWorkspace
-								? `${devLabelWord(currentWorkspaceData?.dev_workspace_label)} workspace of`
-								: 'Fork of'}
-							<b>{parentWorkspaceData?.name}</b
-							>{#if parentWorkspaceData?.name !== parentWorkspaceId}
-								({parentWorkspaceId}){/if}
-						</span>
-					</div>
-
-					{#if loading}
-						<span class="text-xs text-blue-600 dark:text-blue-400"> Checking for changes... </span>
-					{:else if error}
-						<span class="text-xs text-red-600 dark:text-red-400">
-							{error}
-						</span>
-					{:else if comparison}
-						<div class="flex items-center flex-wrap gap-x-4 gap-y-1 text-xs min-w-0">
-							{#if comparison.summary.total_diffs > 0}
-								<span class="text-blue-700 dark:text-blue-100">
-									{forkAheadBehindMessage(changesAhead, changesBehind)}
-									<span class="font-semibold underline">{parentWorkspaceId}</span> over {comparison
-										.summary.total_diffs} items<span class="hidden lg:inline">:</span>
-								</span>
-								<!-- The per-kind breakdown is the first thing to go on a narrow
-								     viewport: the item total above already sizes the change set, and
-								     the compare page carries the detail. -->
-								<div
-									class="hidden lg:flex items-center flex-wrap gap-x-2 gap-y-1 whitespace-nowrap"
-								>
-									{#if comparison.summary.scripts_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.scripts_changed} script{comparison.summary
-												.scripts_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.flows_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.flows_changed} flow{comparison.summary.flows_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.apps_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.apps_changed} app{comparison.summary.apps_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.resources_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.resources_changed} resource{comparison.summary
-												.resources_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.variables_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.variables_changed} variable{comparison.summary
-												.variables_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.resource_types_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.resource_types_changed} resource type{comparison.summary
-												.resource_types_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.folders_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.folders_changed} folder{comparison.summary
-												.folders_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.schedules_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.schedules_changed} schedule{comparison.summary
-												.schedules_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.triggers_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.triggers_changed} trigger{comparison.summary
-												.triggers_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-								</div>
-
-								{#if ciTestTotal > 0}
-									-
-									{#if ciTestFailing > 0}
-										<div
-											class="flex items-center gap-1 text-red-600 dark:text-red-400 whitespace-nowrap"
-										>
-											<CircleX class="w-3 h-3" />
-											<span>CI: {ciTestFailing} failing</span>
-										</div>
-									{:else if ciTestRunning > 0}
-										<div
-											class="flex items-center gap-1 text-yellow-600 dark:text-yellow-400 whitespace-nowrap"
-										>
-											<Loader2 class="w-3 h-3 animate-spin" />
-											<span>CI: {ciTestRunning} running</span>
-										</div>
-									{:else}
-										<div
-											class="flex items-center gap-1 text-green-600 dark:text-green-400 whitespace-nowrap"
-										>
-											<CircleCheck class="w-3 h-3" />
-											<span>CI: {ciTestPassing} passing</span>
-										</div>
-									{/if}
-								{/if}
-
-								{#if comparison.summary.conflicts > 0}
-									-
-									<div
-										class="flex items-center gap-1 text-orange-600 dark:text-orange-400 whitespace-nowrap"
-									>
-										<AlertTriangle class="w-3 h-3" />
-										<span
-											>{comparison.summary.conflicts} conflict{comparison.summary.conflicts !== 1
-												? 's'
-												: ''}</span
-										>
-									</div>
-								{/if}
-							{:else if comparison.skipped_comparison}
-								<span class="text-blue-600 dark:text-blue-200">
-									This {currentNoun} was created before the addition of certain windmill features, and
-									therefore the changes with its parent workspace cannot be displayed.</span
-								>
-							{:else if showDraftsOnly}
-								<span class="text-blue-700 dark:text-blue-100">
-									This workspace has {draftCount} draft{draftCount !== 1 ? 's' : ''}
-								</span>
-							{:else}
-								<span class="text-blue-600 dark:text-blue-200"> Everything is up to date </span>
-							{/if}
-						</div>
-					{/if}
-				</div>
-
-				<div class="flex items-center gap-2 shrink-0">
-					<Button
-						variant="default"
-						unifiedSize="sm"
-						onclick={showDraftsOnly ? openDraftCompare : openComparisonDrawer}
-					>
-						{#if showDraftsOnly}
-							Review & deploy drafts
-						{:else if !hasAnswer || changesAhead > 0}
-							Review & Deploy Changes
-						{:else}
-							Review & Update {currentNoun}
-						{/if}
-					</Button>
-				</div>
-			</div>
-		</div>
-	</div>
+	<!-- In the band, not a banner: the breadcrumb already says which fork this is, so all this has
+	     to carry is how far it has drifted and the way to review that. The per-kind breakdown, the
+	     CI line and the conflict count live on the compare page the button opens. -->
+	<PageHeaderContent actions={forkAction} />
 {/if}
+
+{#snippet forkAction()}
+	{@const total = comparison?.summary.total_diffs ?? 0}
+	{@const conflicts = comparison?.summary.conflicts ?? 0}
+	<!-- What the comparison has to say is a mark beside the button, never instead of it: a fork
+	     still being counted, or one whose count failed, is exactly when a reader wants the page
+	     that does the counting properly. The button below renders in every state. -->
+	{#if loading}
+		<span class="text-2xs text-tertiary">Checking for changes…</span>
+	{:else if error}
+		<span class="text-2xs text-red-600 dark:text-red-400" title={error}>Comparison failed</span>
+	{:else if showDraftsOnly}
+		<Badge color="blue" small>
+			{draftCount} draft{draftCount !== 1 ? 's' : ''}
+		</Badge>
+	{:else if total > 0}
+		<!-- Which way the drift goes is the thing to know at a glance: ahead is what this fork has
+		     to give its parent, behind is what it has yet to take. -->
+		<!-- The colours and the icons the compare page gives these three, so the counts in the bar
+		     and the rows behind the button say the same thing the same way. -->
+		{#if changesAhead > 0}
+			<Badge
+				color="green"
+				small
+				clickable
+				onclick={() => openCompareDir('deploy_to')}
+				title="{changesAhead} ahead of {parentWorkspaceId} — review what this {currentNoun} has to give"
+			>
+				<ArrowUp class="w-3 h-3 inline" />
+				{changesAhead}{compactCounts ? '' : ' ahead'}
+			</Badge>
+		{/if}
+		{#if changesBehind > 0}
+			<Badge
+				color="blue"
+				small
+				clickable
+				onclick={() => openCompareDir('update')}
+				title="{changesBehind} behind {parentWorkspaceId} — review what this {currentNoun} has yet to take"
+			>
+				<ArrowDown class="w-3 h-3 inline" />
+				{changesBehind}{compactCounts ? '' : ' behind'}
+			</Badge>
+		{/if}
+		{#if conflicts > 0}
+			<!-- A conflict is ahead and behind at once, so it has no direction of its own; it opens
+			     the side the reader resolves it from before deploying. -->
+			<Badge
+				color="orange"
+				small
+				clickable
+				onclick={() => openCompareDir('deploy_to')}
+				title="{conflicts} conflicting item{conflicts !== 1 ? 's' : ''} — review them"
+			>
+				<AlertTriangle class="w-3 h-3 inline" />
+				{conflicts}{compactCounts ? '' : ` conflict${conflicts !== 1 ? 's' : ''}`}
+			</Badge>
+		{/if}
+		<!-- Drafts are a different axis from the drift beside them: ahead and behind count deployed
+		     items against the parent, this counts work in this fork that is not deployed anywhere
+		     yet. It shares blue with "behind" and is told apart by the pencil and by naming what it
+		     counts, rather than by an arrow that would read as a third direction. Clicking goes to
+		     the drafts half of the compare page rather than the drawer the button opens. It shows at
+		     every drift — a fork both behind and holding drafts said nothing about the drafts. -->
+		{#if draftCount > 0}
+			<Badge
+				color="blue"
+				small
+				clickable
+				onclick={openDraftCompare}
+				title="{draftCount} draft{draftCount !== 1
+					? 's'
+					: ''} in this {currentNoun}, not deployed anywhere yet — review and deploy"
+			>
+				<Pencil class="w-3 h-3 inline" />
+				{draftCount}{compactCounts ? '' : ` draft${draftCount !== 1 ? 's' : ''}`}
+			</Badge>
+		{/if}
+	{/if}
+	{#if showDraftsOnly}
+		<Button
+			variant="subtle"
+			unifiedSize="sm"
+			onclick={openDraftCompare}
+			title={`Review and deploy this workspace's drafts`}
+		>
+			Review & deploy drafts
+		</Button>
+	{:else}
+		<Button
+			variant="subtle"
+			unifiedSize="sm"
+			onclick={openComparisonDrawer}
+			title={hasAnswer
+				? `${forkAheadBehindMessage(changesAhead, changesBehind)} ${parentWorkspaceId} over ${total} items`
+				: `Review this ${currentNoun} against ${parentWorkspaceId}`}
+		>
+			{#if !hasAnswer || changesAhead > 0}
+				Review changes
+			{:else}
+				Review & Update {currentNoun}
+			{/if}
+		</Button>
+	{/if}
+{/snippet}
diff --git a/frontend/src/lib/components/JobArgs.svelte b/frontend/src/lib/components/JobArgs.svelte
index 64ca912608..e0712d66c7 100644
--- a/frontend/src/lib/components/JobArgs.svelte
+++ b/frontend/src/lib/components/JobArgs.svelte
@@ -15,6 +15,7 @@
 	import { isWindmillTooBigObject } from './job_args'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { appendViewToken } from '$lib/viewToken'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 
 	interface Props {
 		id?: string | undefined
@@ -246,7 +247,7 @@ ${Object.entries(displayArgs)
 		If using the wmill client in your code, set the following env variables:
 		<pre
 			><code
-				>BASE_URL="{window.location.origin}"
+				>BASE_URL="{apiBaseUrl()}"
 WM_TOKEN="{'<TOKEN>'}"</code
 			></pre
 		>
diff --git a/frontend/src/lib/components/NavBreadcrumb.svelte b/frontend/src/lib/components/NavBreadcrumb.svelte
new file mode 100644
index 0000000000..3081bcca4c
--- /dev/null
+++ b/frontend/src/lib/components/NavBreadcrumb.svelte
@@ -0,0 +1,434 @@
+<!--
+@component
+The page header's breadcrumb: workspace / fork / kind / path, in one flat line.
+
+Every segment is a trigger for the picker that changes it — the workspace menu, the fork family
+picker, and the item drill picker for the kind and each path level — and all of them share one
+size and one icon size, so the line reads as one control rather than four.
+
+Two weights, not one: the segment that ends the trail is what the page is about and carries the
+weight, and everything leading to it is a step quieter. Which segment that is depends on the
+route — the workspace on home, a list page's own name, an item's summary (which the band draws,
+not this component) — so the lead can run the whole line.
+-->
+<script lang="ts">
+	import { Building, ChevronDown, Folder, GitFork, User } from 'lucide-svelte'
+	import WorkspaceItemKindIcon from './WorkspaceItemKindIcon.svelte'
+	import { Menu, Menubar } from '$lib/components/meltComponents'
+	import MeltButton from '$lib/components/meltComponents/MeltButton.svelte'
+	import BreadcrumbItemContent from './BreadcrumbItemContent.svelte'
+	import WorkspacePickerBody from '$lib/components/sidebar/WorkspacePickerBody.svelte'
+	import BreadcrumbSegment from '$lib/components/BreadcrumbSegment.svelte'
+	import { userWorkspaces, workspaceStore, workspaceColor, superadmin } from '$lib/stores'
+	import { findWorkspaceRoot } from '$lib/utils/workspaceHierarchy'
+	import { useForkableWorkspaces } from '$lib/utils/useForkableWorkspaces.svelte'
+	import { base } from '$lib/base'
+	import { twMerge } from 'tailwind-merge'
+	import { Badge } from '$lib/components/common'
+	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
+	import { forkAccentStyle } from '$lib/utils/forkColor'
+	import DevWorkspaceBadge from './DevWorkspaceBadge.svelte'
+	import { page } from '$app/state'
+	import { navPageFor } from './sidebar/navPages'
+	import { copyToClipboard, getContrastTextColor } from '$lib/utils'
+	import { KIND_LABEL_LOWER, kindKey } from '$lib/components/workspacePicker'
+	import type { PageHeaderItem, PageHeaderSection } from './pageHeaderRegistry.svelte'
+	import type { Snippet } from 'svelte'
+
+	let {
+		item,
+		section,
+		afterName,
+		actingWorkspaceId,
+		narrow = false,
+		nameOnly = false
+	}: {
+		item?: PageHeaderItem
+		section?: PageHeaderSection
+		/** What sits beside the page's name: a mark like a documentation tooltip, or a control
+		 *  that acts on the thing named. */
+		afterName?: Snippet
+		/** The workspace the page acts on, when it differs from the one the app is pointed at. */
+		actingWorkspaceId?: string
+		/** The bar is short of room: the path holds a tighter cap, so it cannot claim a third of the
+		 *  line before anything else has given way. The names truncate at every width either way. */
+		narrow?: boolean
+		/** Only the page's own name, with no workspace part and no picker — the band inside a
+		 *  session's preview frame, where the workspace is the host's and leading the reader out of
+		 *  it is exactly what that band must not offer. The page still has to say what it is. */
+		nameOnly?: boolean
+	} = $props()
+
+	const scopeId = $derived(actingWorkspaceId ?? $workspaceStore ?? undefined)
+	const homeHref = $derived(
+		actingWorkspaceId ? `${base}/?workspace=${encodeURIComponent(actingWorkspaceId)}` : `${base}/`
+	)
+
+	// With no item or section registered, the route still says where the user is: Runs, Variables,
+	// and the rest name themselves in the breadcrumb rather than leaving it at the workspace.
+	// Home is the root the workspace part already stands for, so it names no page of its own.
+	const routePage = $derived.by(() => {
+		if (item || section) return undefined
+		const found = navPageFor(page.url.pathname, base)
+		return found?.path === '/' ? undefined : found
+	})
+
+	/** One look for every segment, whichever picker it opens. */
+	const SEGMENT =
+		'flex items-center gap-1 min-w-0 px-1 py-0.5 rounded text-xs font-normal text-primary hover:bg-surface-hover hover:text-emphasis transition-colors'
+	/** The trail up to the last segment: where the thing lives, which the reader scans past. */
+	const LEAD = 'font-normal text-secondary'
+	/** The last segment: what the page is about, and the only part of the line with weight. */
+	const LAST = 'font-medium text-emphasis'
+	const ICON = 14
+	/** The workspace disc: the same glyph as the rest, with a ring of its own around it. */
+	const DISC = 20
+
+	/** Width of the name beside the chevron, so the picker can hang from the part's own left edge. */
+	let nameWidth = $state(0)
+	let workspaceMenu: Menu | undefined = $state(undefined)
+
+	// Its own confirmation under the path rather than the global toast: the answer belongs where
+	// the click was, and a toast for something this small is a lot of furniture.
+	let pathCopied = $state(false)
+	let copiedReset: ReturnType<typeof setTimeout> | undefined
+	async function copyPath() {
+		if (!item?.path || !(await copyToClipboard(item.path, false))) return
+		pathCopied = true
+		clearTimeout(copiedReset)
+		copiedReset = setTimeout(() => (pathCopied = false), 1500)
+	}
+
+	const family = $derived(findWorkspaceRoot(scopeId, $userWorkspaces ?? []))
+	const discColor = $derived(family?.color ?? $workspaceColor ?? 'rgb(var(--color-surface-sunken))')
+	const glyphColor = $derived(getContrastTextColor(discColor))
+
+	const forkable = useForkableWorkspaces({
+		workspaces: () => $userWorkspaces,
+		currentWorkspaceId: () => scopeId,
+		isSuperadmin: () => !!$superadmin
+	})
+	const forkableWorkspaces = $derived(forkable.current)
+	const currentWs = $derived(forkableWorkspaces.find((w) => w.id === scopeId))
+	const inFork = $derived(!!currentWs?.parent_workspace_id)
+	const showFork = $derived(inFork)
+	const familyName = $derived(family?.name ?? scopeId ?? '')
+	// The workspace the user actually stands in, which is the fork's own name inside a fork.
+	const scopeName = $derived(currentWs?.name ?? familyName)
+
+	// A fork wears its workspace colour and, for a dev workspace, its environment badge — the same
+	// two marks the fork chip carries everywhere else.
+	const forkAccent = $derived(inFork ? forkAccentStyle(currentWs?.color) : undefined)
+	// A dev workspace wears its environment; the root wears "prod", so which environment the user
+	// is standing in is answered the same way whichever one it is.
+	/** Whether this family has a dev workspace anywhere under it. */
+	const familyHasDev = $derived.by(() => {
+		const all = $userWorkspaces ?? []
+		const root = family?.id
+		return (
+			!!root && all.some((w) => w.is_dev_workspace && findWorkspaceRoot(w.id, all)?.id === root)
+		)
+	})
+	const envBadge = $derived.by(() => {
+		// "prod" only where a dev workspace exists to be the other half of the pair: a family with
+		// one environment gains nothing from naming it.
+		if (!inFork) return familyHasDev ? 'prod' : undefined
+		if (currentWs?.is_dev_workspace) return 'dev'
+		return undefined
+	})
+
+	// Which segment ends the trail, and so carries the weight. Everything before it is `LEAD`: on
+	// home that is nothing and the workspace itself is the subject, on a list page the page's name
+	// takes over, and on an item page the summary does — so the workspace, the fork and the path
+	// all step back to make room for it.
+	const namedAfterWorkspace = $derived(!!item || !!section || !!routePage)
+	const workspaceIsLast = $derived(!nameOnly && !namedAfterWorkspace)
+	// The summary is the band's, not the breadcrumb's (see PageHeaderBar), so the path reads as the
+	// last segment only for an item that has no summary to follow it.
+	const itemIsLast = $derived(!!item && !item.summaryContent && !item.summary)
+
+	// No hover fill: the chevron beside it is what reacts to the pointer. The accent stays on the
+	// fork's own name inside, so the family's name is not painted as if it were the fork.
+	//
+	// Inside a fork the family's name is the lead even where the workspace part ends the trail: the
+	// workspace the user stands in is the fork, and the family before it says which product that
+	// fork belongs to. Weighting both would name two workspaces as the subject.
+	const scopeChipClass = $derived(
+		twMerge(SEGMENT, 'hover:bg-transparent', workspaceIsLast && !showFork ? LAST : LEAD)
+	)
+
+	// Capped: a draft's path is a 40-character uuid slug, and the trail yields so grudgingly that
+	// one would push a page's buttons off the end of the bar.
+	const pathSegment = $derived(
+		twMerge(
+			SEGMENT,
+			'gap-1.5 overflow-hidden',
+			itemIsLast ? LAST : LEAD,
+			narrow ? 'max-w-[11rem]' : 'max-w-[16rem]'
+		)
+	)
+	// Copying is the one thing a segment does that leaves no mark on the page, so it is the one
+	// without a hover fill: the pointer and the confirmation under it are the affordance. A segment
+	// that opens the rename editor keeps the fill, which is what tells the two apart on sight.
+	const copyPathSegment = $derived(twMerge(pathSegment, 'hover:bg-transparent'))
+
+	// The chip keeps its colour wherever it is on the line — that colour is how a fork is told apart
+	// from its family. Only its weight follows the trail, dropping back once a page's name ends it.
+	const forkChipClass = $derived(
+		twMerge(
+			'flex items-center gap-1 min-w-0 px-1 rounded',
+			// A filled chip needs room around what it holds; an uncolored one is just the name and
+			// would only be pushed away from the slash before it.
+			forkAccent &&
+				'px-1.5 py-0.5 bg-[color:var(--fork-accent-bg)] dark:bg-[color:var(--fork-accent-bg-dark)] text-[color:var(--fork-accent-text)] dark:text-[color:var(--fork-accent-text-dark)]',
+			// Where the workspace part ends the trail, the fork is the segment that ends it, so it
+			// takes the weight on its own. Without a colour of its own it also has to take the text
+			// colour, since it would otherwise inherit the lead's from the link around it.
+			workspaceIsLast ? twMerge('font-semibold', !forkAccent && 'text-emphasis') : 'font-normal'
+		)
+	)
+
+	/** `f/demo` and `u/alice` name a folder and a user: the prefix becomes the path's icon. */
+	const scopeKind = $derived(item?.path?.split('/')[0])
+	/** The path's levels, the `f`/`u` prefix dropped — that is what the icon says. */
+	const pathLevels = $derived((item?.path ?? '').split('/').slice(1).filter(Boolean))
+</script>
+
+{#snippet workspaceDisc()}
+	<!-- The glyph is the same size as every other icon on the line; only the disc around it is
+	     larger, by the ring it needs to read as a disc at all. -->
+	<svg width={DISC} height={DISC} viewBox="0 0 {DISC} {DISC}" class="flex-shrink-0">
+		<circle cx={DISC / 2} cy={DISC / 2} r={DISC / 2} fill={discColor} />
+		<foreignObject x={(DISC - ICON) / 2} y={(DISC - ICON) / 2} width={ICON} height={ICON}>
+			<Building size={ICON} style={glyphColor ? `color: ${glyphColor}` : undefined} />
+		</foreignObject>
+	</svg>
+{/snippet}
+
+{#snippet itemKindIcon()}
+	<!-- No kind, no glyph: WorkspaceItemKindIcon falls through to the script icon, which would
+	     label an agent a script. -->
+	{#if item?.kind}<WorkspaceItemKindIcon kind={item.kind} size={ICON} />{/if}
+{/snippet}
+
+{#snippet sectionKindIcon()}
+	{#if section?.kind}<WorkspaceItemKindIcon kind={section.kind} size={ICON} />{/if}
+{/snippet}
+
+{#snippet folderIcon()}
+	<Folder size={ICON} class="flex-shrink-0 text-tertiary" />
+{/snippet}
+
+{#snippet userIcon()}
+	<User size={ICON} class="flex-shrink-0 text-tertiary" />
+{/snippet}
+
+{#snippet envBadgeMark()}
+	{#if envBadge === 'dev'}
+		<DevWorkspaceBadge
+			label={currentWs?.dev_workspace_label}
+			color={currentWs?.color}
+			fallbackClass="dark:bg-surface-accent-primary text-white dark:text-white"
+			class="text-3xs px-1 py-0"
+		/>
+	{:else if envBadge === 'prod'}
+		<Badge color="gray" small class="text-3xs px-1 py-0">prod</Badge>
+	{/if}
+{/snippet}
+
+{#snippet slash(extra = '')}
+	<!-- `extra` tops the workspace part's own 4px gap up to the 6px the breadcrumb puts around its
+	     other separators, so the slash before a fork is spaced like every other slash on the line. -->
+	<span class={twMerge('shrink-0 text-hint/40 text-xs', extra)} aria-hidden="true">/</span>
+{/snippet}
+
+<nav
+	aria-label="Breadcrumb"
+	class="flex items-center gap-1.5 min-w-0 text-xs font-normal text-primary"
+>
+	{#if !nameOnly}
+		<!-- One part for where the user is: the name of the workspace they are standing in — a fork
+	     included, in its own colour — leading home, and one chevron whose picker changes it. The
+	     picker lists the families and expands one to reach its forks, so a fork needs no part of
+	     its own here. -->
+		<!-- `shrink-[999]`: the whole trail can give width back, and this part gives it first. Flex
+		     takes it from the parts in proportion to what they ask for, so a factor this far above
+		     the rest means the names here are eaten down to their icons before the page's own name
+		     loses a character. -->
+		<div class="flex items-center min-w-0 shrink-[999]">
+			<!-- No hover fill on the name: the chevron beside it is the thing that lights up, and two
+		     boxes reacting to one pass of the pointer read as two controls fighting. -->
+			<!-- bind:clientWidth: the menu hangs from the chevron, so it is shifted back by the width of
+		     the name to line its left edge up with the disc. -->
+			<div class="flex items-center min-w-0" bind:clientWidth={nameWidth}>
+				<a
+					href={homeHref}
+					class={scopeChipClass}
+					title={showFork ? `${familyName} / ${scopeName}` : familyName}
+				>
+					<!-- The family's name goes before the fork's: the fork is where the work happens, the
+					     family is which product it is part of, and of the two that is the one a reader can
+					     do without. Both truncate to nothing rather than disappearing at a breakpoint —
+					     what is left then is what the part cannot be read without, the disc in the
+					     workspace's own colour, the fork mark and the environment. The hover title
+					     carries the names whole, and the picker beside it names them all. -->
+					<span class="flex items-center gap-1 min-w-0 shrink-[999]">
+						<BreadcrumbItemContent label={familyName} icon={workspaceDisc} />
+					</span>
+					{#if showFork}
+						{@render slash('mx-0.5')}
+						<span class={forkChipClass} style={forkAccent}>
+							<GitFork size={ICON} class="flex-shrink-0" />
+							<span class="truncate">{scopeName}</span>
+							{@render envBadgeMark()}
+						</span>
+					{:else}
+						{@render envBadgeMark()}
+					{/if}
+				</a>
+			</div>
+			<Menubar>
+				{#snippet children({ createMenu })}
+					<Menu
+						bind:this={workspaceMenu}
+						{createMenu}
+						usePointerDownOutside
+						placement="bottom-start"
+						contentStyle="margin-left: {-nameWidth}px"
+					>
+						{#snippet triggr({ trigger })}
+							<MeltButton
+								meltElement={trigger}
+								class="flex items-center p-1.5 rounded text-tertiary hover:bg-surface-hover hover:text-primary transition-colors"
+								title="Switch workspace"
+							>
+								<ChevronDown size={ICON} class="flex-shrink-0" />
+							</MeltButton>
+						{/snippet}
+						{#snippet children({ item: menuItem })}
+							<WorkspacePickerBody
+									item={menuItem}
+									collapseFamilies={actingWorkspaceId != undefined}
+									closeMenu={() => workspaceMenu?.close()}
+								/>
+						{/snippet}
+					</Menu>
+				{/snippet}
+			</Menubar>
+		</div>
+	{/if}
+
+	{#if !nameOnly && (item || section || routePage)}
+		{@render slash()}
+	{/if}
+
+	{#if item}
+		{#if item.path}
+			<!-- The path whole, as one label rather than a row of pickers: it is what a person reads
+			     to know which item this is, and what they reach for to paste somewhere else. -->
+			<div class="relative flex items-center min-w-0">
+				<!-- Past the cap the trail truncates; whatever the click does still has the path whole. -->
+				{#snippet pathLabel()}
+					{#if scopeKind === 'u'}
+						{@render userIcon()}
+					{:else}
+						{@render folderIcon()}
+					{/if}
+					{#each pathLevels as level, i (i)}
+						{#if i > 0}{@render slash()}{/if}
+						<!-- The scopes above the name absorb the squeeze, the name itself last: a path is
+						     read from its end, and which folder a thing is in is answerable from the
+						     picker while the thing's own name is not. -->
+						<span
+							class={i === pathLevels.length - 1
+								? 'truncate'
+								: 'truncate min-w-0 shrink-[999] max-w-[8rem]'}>{level}</span
+						>
+					{/each}
+				{/snippet}
+				{#if item.pathTrigger}
+					<!-- The page hangs its own rename off this segment, anchored here so the editor
+					     opens under the path rather than beside the summary. It wears the segment's
+					     own classes, so a clickable path reads the same as one that only copies. -->
+					{@render item.pathTrigger(pathLabel, pathSegment)}
+				{:else}
+					<button
+						class={copyPathSegment}
+						title="Copy path"
+						onclick={copyPath}
+						aria-label="Copy path {item.path}"
+					>
+						{@render pathLabel()}
+					</button>
+				{/if}
+				{#if afterName}{@render afterName()}{/if}
+				{#if pathCopied}
+					<span
+						class="absolute left-0 top-full mt-1 z-[6000] rounded-md border bg-surface px-2 py-1 text-2xs text-secondary shadow-md whitespace-nowrap"
+						role="status"
+					>
+						Path copied successfully
+					</span>
+				{/if}
+			</div>
+		{:else if item.kind}
+			<!-- The path is on its way: a page registers its kind as soon as it mounts and fills the
+			     path once it has loaded one. Naming the kind here reads as the answer and then jumps
+			     when the real path replaces it, so hold its place instead. The width is a plausible
+			     path's, which is what keeps the trail from shifting when it lands. -->
+			<span
+				class={twMerge(SEGMENT, 'hover:bg-transparent', itemIsLast ? LAST : LEAD)}
+				aria-label="Loading {KIND_LABEL_LOWER[item.kind]} path"
+				aria-busy="true"
+			>
+				{@render itemKindIcon()}
+				<Skeleton layout={[[{ h: 0.75, w: 100, minW: 96 }]]} class="w-24" />
+			</span>
+		{/if}
+	{:else if section?.kind}
+		<BreadcrumbSegment
+			label={KIND_LABEL_LOWER[section.kind]}
+			icon={sectionKindIcon}
+			extraClass={twMerge(SEGMENT, LAST)}
+			isCurrent
+			initialHighlight={kindKey(section.kind)}
+			initialScope={{ kind: section.kind }}
+			onPick={() => {}}
+		/>
+	{:else if section}
+		{#if section.parent}
+			<!-- Gives width back with the workspace part, before the section's own name does. -->
+			<span
+				class={twMerge(SEGMENT, LEAD, 'shrink-[999] hover:bg-transparent hover:text-secondary')}
+			>
+				<span class="truncate">{section.parent}</span>
+			</span>
+			{@render slash()}
+		{/if}
+		<!-- A section's own widget lays out as a row: its title, and whatever belongs with it. -->
+		<span
+			class={twMerge(
+				SEGMENT,
+				LAST,
+				'hover:bg-transparent hover:text-emphasis',
+				section.content ? '' : 'truncate'
+			)}
+			aria-current="page"
+		>
+			{#if section.content}{@render section.content()}{:else}{section.label}{/if}
+		</span>
+		{#if afterName}{@render afterName()}{/if}
+	{:else if routePage}
+		{@const RouteIcon = routePage.icon}
+		<!-- shrink-0: a page's own name is short and is the one part of the trail worth keeping
+		     whole, so the workspace and fork names give way first when the bar is full. -->
+		<span
+			class={twMerge(SEGMENT, LAST, 'shrink-0 hover:bg-transparent hover:text-emphasis')}
+			aria-current="page"
+		>
+			{#if RouteIcon}<RouteIcon size={ICON} class="flex-shrink-0 text-tertiary" />{/if}
+			<span class="truncate">{routePage.label}</span>
+		</span>
+		{#if afterName}{@render afterName()}{/if}
+	{/if}
+</nav>
diff --git a/frontend/src/lib/components/NoDirectDeployAlert.svelte b/frontend/src/lib/components/NoDirectDeployAlert.svelte
index d1017f7347..a3a249caf5 100644
--- a/frontend/src/lib/components/NoDirectDeployAlert.svelte
+++ b/frontend/src/lib/components/NoDirectDeployAlert.svelte
@@ -16,7 +16,8 @@
 	import { findCanonicalDevWorkspace } from '$lib/utils/workspaceHierarchy'
 	import { devLabelKey, devLabelNoun } from '$lib/utils/devWorkspaceLabel'
 	import { switchWorkspace } from '$lib/storeUtils'
-	import { Badge, Button } from './common'
+	import { Button, ButtonType } from './common'
+	import { twMerge } from 'tailwind-merge'
 	import Popover from './meltComponents/Popover.svelte'
 	import Toggle from './Toggle.svelte'
 	import { GitFork, Lock, ShieldOff } from 'lucide-svelte'
@@ -83,28 +84,35 @@
 				? `Edits in ${devLabelKey(canonicalDev.dev_workspace_label)}`
 				: 'Edits restricted'
 	)
+
+	// The Popover renders its trigger as a <button>, so this wears the design system's subtle
+	// button rather than containing one — a <Button> here would nest a button inside a button.
+	const triggerClass = twMerge(
+		'inline-flex items-center gap-1 rounded-md whitespace-nowrap transition-all',
+		ButtonType.VariantStyles.subtle,
+		ButtonType.UnifiedSizingClasses.sm,
+		ButtonType.UnifiedHeightClasses.sm,
+		ButtonType.UnifiedFontSizes.sm,
+		'text-xs'
+	)
 </script>
 
 {#if !operatingUser.current?.operator && activeDeployRulesets.length > 0}
 	<div class="my-2">
 		<Popover
 			placement="bottom-start"
-			class="inline-flex items-center"
+			class={triggerClass}
 			triggerAttrs={{ 'aria-label': badgeLabel }}
 		>
 			{#snippet trigger()}
-				<!-- `clickable` is unusable here: it renders the badge as a <button>, nested inside the
-				     one Popover wraps its trigger in. -->
-				<Badge small color={bypassActive ? 'yellow' : 'blue'} class="cursor-pointer">
-					{#if bypassActive}
-						<ShieldOff class="h-3 w-3" />
-					{:else if canonicalDev}
-						<GitFork class="h-3 w-3" />
-					{:else}
-						<Lock class="h-3 w-3" />
-					{/if}
-					{badgeLabel}
-				</Badge>
+				{#if bypassActive}
+					<ShieldOff size={ButtonType.UnifiedIconSizes.sm} class="shrink-0" />
+				{:else if canonicalDev}
+					<GitFork size={ButtonType.UnifiedIconSizes.sm} class="shrink-0" />
+				{:else}
+					<Lock size={ButtonType.UnifiedIconSizes.sm} class="shrink-0" />
+				{/if}
+				{badgeLabel}
 			{/snippet}
 			{#snippet content()}
 				<div class="flex flex-col gap-3 p-4 text-xs max-w-sm">
diff --git a/frontend/src/lib/components/PageHeaderBar.svelte b/frontend/src/lib/components/PageHeaderBar.svelte
new file mode 100644
index 0000000000..0cc47e58ca
--- /dev/null
+++ b/frontend/src/lib/components/PageHeaderBar.svelte
@@ -0,0 +1,227 @@
+<!--
+@component
+The bar every route wears, above the page content and beside the sidebar: the sidebar toggle, the
+workspace picker, then whatever the route registered — an item's breadcrumb and summary, or a
+section name — and the route's own buttons at the far end.
+
+The row's height matches the sidebar's own header row, so the two read as one band.
+-->
+<script lang="ts">
+	import { PanelLeft } from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
+	import { navDetached } from './sidebar/navDetached.svelte'
+	import { navHandleSlot } from './sidebar/navHandlePlacement.svelte'
+	import NavBreadcrumb from './NavBreadcrumb.svelte'
+	import { BAR_HEIGHT, pageHeader, PHONE_BAR } from './pageHeaderRegistry.svelte'
+	import ContextBridge from './ContextBridge.svelte'
+	import { afterNavigate } from '$app/navigation'
+	import { twMerge } from 'tailwind-merge'
+
+	let {
+		navHidden = false,
+		panelled = false
+	}: {
+		navHidden?: boolean
+		/** The sidebar is a panel over the page rather than a rail beside it — detached, or a
+		 *  window too narrow to seat one. Either way this bar carries the switch that opens it. */
+		panelled?: boolean
+	} = $props()
+
+	const content = $derived(pageHeader.content)
+	const actions = $derived(pageHeader.actions)
+
+	const item = $derived(content?.item)
+	const section = $derived(content?.section)
+	const hasSummary = $derived(!!item && !!(item.summaryContent || item.summary))
+
+	// Below this the trail holds a tighter cap on the path it draws. The names in it truncate on
+	// their own at any width (see NavBreadcrumb), so this is not a breakpoint the look changes at —
+	// it only stops a long path from claiming a third of a short bar before the squeeze starts.
+	const NARROW_BAR = 1000
+	const narrow = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < NARROW_BAR)
+	/** A phone's bar: the trail gives way before the page's buttons do (see the markup). */
+	const phone = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR)
+
+	// The band's edge is there to say "something is passing under me", so it is drawn only while
+	// something is. Scroll events do not bubble, but they do capture, so one listener on the window
+	// sees every box under the band — which matters because most pages scroll inside their own
+	// (the audit table, a detail page's panes) and never move this layout's own scroller.
+	let scrolledUnder = $state(false)
+	/** Sub-pixel layout and a border or two, between a box's top and the content box's. */
+	const AT_THE_TOP_PX = 4
+	function onScrollCapture(e: Event) {
+		const el = e.target as HTMLElement | null
+		if (!el || el.nodeType !== 1) return
+		const box = document.getElementById('content')
+		if (!box || !box.contains(el)) return
+		// The answer this event would give, before measuring anything. While it matches what the
+		// band already draws there is nothing to decide — which is the steady state of a scroll,
+		// and the two rects below each force a synchronous layout. This listener captures every
+		// scroller in the app (Monaco, the audit table, a run's logs), about once a frame while any
+		// of them moves, so the common path has to stay off the layout.
+		const next = el.scrollTop > 0
+		if (next === scrolledUnder) return
+		// Only a box that starts where the content does has anything passing under the band. The
+		// audit page's list begins 285px lower, behind its own chart and column headers, and a
+		// select's option list floats wherever it opens: neither moves anything under the header.
+		const top = el.getBoundingClientRect().top - box.getBoundingClientRect().top
+		if (top > AT_THE_TOP_PX) return
+		scrolledUnder = next
+	}
+	// A page left while scrolled would otherwise hand its edge to the next one, which may have
+	// nothing to scroll at all.
+	afterNavigate(() => (scrolledUnder = false))
+
+	const separator = $derived(pageHeader.content?.separator ?? 'onScroll')
+	const showEdge = $derived(separator === 'always' || (separator === 'onScroll' && scrolledUnder))
+</script>
+
+<svelte:window onscrollcapture={onScrollCapture} />
+
+<!-- The band owns its bottom edge, so a page never draws a second one under it. A page says which
+     rule it wants (see `separator` in the registry); the default shows the edge only while
+     something is passing under the bar. An inset shadow rather than a border: a border would make
+     the row 45px and every page below it would move a pixel the moment the edge appeared. -->
+<div
+	data-page-header
+	bind:clientWidth={() => pageHeader.barWidth, (w) => pageHeader.setBarWidth(w)}
+	class={twMerge(
+		'flex items-center gap-1 shrink-0 min-w-0 bg-surface transition-shadow duration-150',
+		// One row at every width. A wrapping row never squeezes anything — flex moves an item to the
+		// next line instead of taking it below its content width — so wrapping here would hand the
+		// trail a line of its own and leave it whole, which is the opposite of what a narrow bar
+		// wants: the trail truncating from its start.
+		phone ? `${BAR_HEIGHT} pl-1 pr-2` : `${BAR_HEIGHT} pl-2 pr-4`,
+		// The filling surface is what meets the right edge, so the bar keeps no gutter of its own
+		// there.
+		content?.actionsFill && 'pr-0',
+		// The small left padding is there to sit a button against: the sidebar handle, or the
+		// workspace disc, both of which carry their own visual margin. Embedded there is neither,
+		// and the page's name would start as bare text 8px from the edge.
+		navHidden && 'pl-4',
+		showEdge &&
+			'shadow-[inset_0_-1px_0_0_rgb(var(--color-border-light))] dark:shadow-[inset_0_-1px_0_0_#374151] [html.github-dark_&]:shadow-[inset_0_-1px_0_0_rgb(var(--color-border-light))]'
+	)}
+>
+	{#if (navDetached.val || panelled) && !navHidden}
+		<!-- Reveals the hidden sidebar, and only that: the card follows the pointer, holding while it
+		     is on the handle, on the card, or in a menu either opened, and sliding back out when it
+		     leaves. Where no pointer hovers, a tap opens it and it stays until dismissed. Attaching
+		     it for good belongs to the toggle in the sidebar's own footer, where detaching it
+		     happened. Docked, the sidebar speaks for itself and nothing leads the bar. -->
+		<!-- svelte-ignore a11y_no_static_element_interactions -->
+		<div
+			data-nav-handle
+			onmouseenter={() => navHandleSlot.open()}
+			onmouseleave={() => navHandleSlot.scheduleClose()}
+		>
+			<!-- No tooltip: hovering here already slides the sidebar in, which says what the button
+			     does better than a label popping up over it. -->
+			<Button
+				variant="subtle"
+				unifiedSize="sm"
+				iconOnly
+				startIcon={{ icon: PanelLeft }}
+				aria-label="Show sidebar"
+				onclick={() => navHandleSlot.open()}
+			/>
+		</div>
+	{/if}
+
+	<!-- The breadcrumb yields width more slowly than the page's controls (shrink-[0.3]) but it does
+	     yield, at every width: the trail truncates from its start, so the squeeze is spent on the
+	     workspace and the folders before it ever reaches the name of the thing the page is about.
+	     The 5rem floor is what is left when every name in it has gone — the workspace disc, the
+	     fork mark and the environment badge, which is as small as the part can be and still say
+	     where the user is.
+	     An embed (`navHidden`) keeps the page's own name but drops the workspace part around it:
+	     the trail would offer to navigate the host's workspace, while the name is what says which
+	     page the controls beside it belong to.
+	     The 0.3 only holds against a summary or an actions box that shrinks too: alone, a factor
+	     sum below 1 makes flex hand out only that share of the overflow, and the bar overflows
+	     instead. -->
+	<div
+		class={twMerge(
+			'flex shrink-[0.3] min-w-[5rem]',
+			!hasSummary &&
+				(actions.length === 0 || (phone && !content?.actionsFlexible && !content?.actionsFill)) &&
+				'shrink'
+		)}
+	>
+		<!-- Bridged like the actions below: what a page hangs off its own name renders here, out of
+		     the tree that named it, and the rename editor in there asks that tree who the acting user
+		     is before it offers to rename anything. -->
+		<!-- Each fragment the band renders comes from another tree and reads that tree's state. The
+		     registry already tolerates a registration that cannot answer while its owner's data is
+		     being cleared (see `read`); the same window reaches rendering, and an error here would
+		     otherwise travel to the root and blank the app rather than the one fragment. A
+		     boundary per fragment keeps that to the fragment. -->
+		<svelte:boundary onerror={(e) => console.error('page header: breadcrumb failed to render', e)}>
+			{#key content?.contexts}
+				<ContextBridge contexts={content?.contexts}>
+					<NavBreadcrumb
+						{item}
+						{section}
+						{narrow}
+						nameOnly={navHidden}
+						afterName={content?.afterName}
+						actingWorkspaceId={content?.actingWorkspaceId}
+					/>
+				</ContextBridge>
+			{/key}
+		</svelte:boundary>
+	</div>
+
+	{#if item && hasSummary}
+		<!-- No kind icon: the page below is the item, and saying "this is a flow" above a flow
+		     editor tells the reader what they can already see. -->
+		<div class={twMerge('flex items-center gap-1 min-w-0', phone && 'shrink')}>
+			<!-- A dot rather than a slash: the summary names the same item the path just located, it
+			     is not another level of it. Inside this box so that it narrows with the summary. -->
+			<span class="shrink-0 text-hint/40 text-xs px-0.5" aria-hidden="true">·</span>
+			{#if item.summaryContent}
+				<svelte:boundary onerror={(e) => console.error('page header: summary failed to render', e)}>
+					{#key content?.contexts}
+						<ContextBridge contexts={content?.contexts}>
+							{@render item.summaryContent()}
+						</ContextBridge>
+					{/key}
+				</svelte:boundary>
+			{:else}
+				<span class="min-w-0 truncate text-xs font-medium text-emphasis">{item.summary}</span>
+			{/if}
+		</div>
+	{/if}
+
+	{#if actions.length > 0}
+		<!-- min-w-0, not shrink-0: a page whose actions are a filter row (Runs) puts a control in
+		     here that can give width back, and it can only do that if this box may shrink. A phone
+		     only tightens the gutter — pages fold their own buttons into a menu at that width, and
+		     a box that refused to shrink would make the one flexible field take its max instead. -->
+		<!-- `actionsFill`: the actions are a surface rather than a row, so they take the rest of the
+		     bar and run to its right edge, and they stretch its full height because that surface
+		     sits on the bottom edge. -->
+		<div
+			class={twMerge(
+				'flex',
+				// pl-4: the gap between the breadcrumb and the filling surface is bare bar, so it
+				// belongs here rather than inside that surface, where it would be filled.
+				content?.actionsFill
+					? 'flex-1 min-w-0 self-stretch items-stretch pl-4'
+					: 'ml-auto items-center',
+				!content?.actionsFill && (phone && !content?.actionsFlexible ? 'shrink-0' : 'min-w-0'),
+				!content?.actionsFill && (phone ? 'gap-1 pl-1' : 'gap-2 pl-4')
+			)}
+		>
+			{#each actions as entry, i (i)}
+				<svelte:boundary onerror={(e) => console.error('page header: actions failed to render', e)}>
+					{#key entry.contexts}
+						<ContextBridge contexts={entry.contexts}>
+							{@render entry.render()}
+						</ContextBridge>
+					{/key}
+				</svelte:boundary>
+			{/each}
+		</div>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/PageHeaderContent.svelte b/frontend/src/lib/components/PageHeaderContent.svelte
new file mode 100644
index 0000000000..2630faf863
--- /dev/null
+++ b/frontend/src/lib/components/PageHeaderContent.svelte
@@ -0,0 +1,43 @@
+<!--
+@component
+Fills the layout's page header from the route that mounts it: the breadcrumb (an item's path, or a
+section name for a list) and the page's own buttons. Renders nothing itself.
+
+Only a route page mounts this. An editor nested in a session pane or a drawer must not take over
+the header, so nesting is decided by the caller rather than guessed from context.
+-->
+<script lang="ts">
+	import { onMount } from 'svelte'
+	import { pageHeader, type PageHeaderContent } from './pageHeaderRegistry.svelte'
+
+	let {
+		item,
+		section,
+		afterName,
+		actions,
+		actionsOrder,
+		actionsFlexible,
+		actionsFill,
+		separator,
+		contexts,
+		actingWorkspaceId,
+		barRightInset
+	}: PageHeaderContent = $props()
+
+	onMount(() => {
+		const id = pageHeader.register(() => ({
+			item,
+			section,
+			afterName,
+			actions,
+			actionsOrder,
+			actionsFlexible,
+			actionsFill,
+			separator,
+			contexts,
+			actingWorkspaceId,
+			barRightInset
+		}))
+		return () => pageHeader.release(id)
+	})
+</script>
diff --git a/frontend/src/lib/components/PathEditPen.svelte b/frontend/src/lib/components/PathEditPen.svelte
new file mode 100644
index 0000000000..c74ea8dded
--- /dev/null
+++ b/frontend/src/lib/components/PathEditPen.svelte
@@ -0,0 +1,37 @@
+<!--
+@component
+The pen that opens an item's summary and path for editing, beside the breadcrumb that shows them.
+
+One affordance for both popovers behind it: an editor's, which edits the draft the next deploy
+writes, and a deployed page's, which saves straight away. They look the same because they mean
+the same thing to a reader — "rename this".
+-->
+<script lang="ts">
+	import { Pencil } from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
+
+	interface Props {
+		/** Names what the popover offers, for the tooltip and the accessible name. */
+		label: string
+		/** `hover` keeps the pen out of the way until the row is hovered, which is what the band
+		 *  wants beside a name; `always` is for a name with nothing else to point at, such as an
+		 *  item with no summary yet. */
+		visibility?: 'hover' | 'always'
+		/** Held visible while the popover it opens is open, whatever `visibility` says. */
+		open?: boolean
+	}
+
+	let { label, visibility = 'hover', open = false }: Props = $props()
+</script>
+
+<Button
+	variant="subtle"
+	unifiedSize="sm"
+	iconOnly
+	startIcon={{ icon: Pencil }}
+	title={label}
+	aria-label={label}
+	btnClasses={visibility === 'hover' && !open
+		? 'opacity-0 transition-opacity group-hover:opacity-100 focus-visible:opacity-100'
+		: ''}
+/>
diff --git a/frontend/src/lib/components/PathEditPopover.svelte b/frontend/src/lib/components/PathEditPopover.svelte
new file mode 100644
index 0000000000..bcf6106be0
--- /dev/null
+++ b/frontend/src/lib/components/PathEditPopover.svelte
@@ -0,0 +1,227 @@
+<!--
+@component
+The editor behind an item's name: clicking the name it is given opens the summary and the path.
+A caller that has no name to give it — a bar with a summary field of its own — gets a pen instead.
+
+A caller that draws the path itself should render it from `snapshotPath ?? path`: while the
+popover is open this holds the path as it was when it opened, so the trail — and the popover
+anchored to it — does not reflow under the pointer as the user types, which floating-ui would
+follow.
+-->
+<script lang="ts">
+	import type { ComponentProps, Snippet } from 'svelte'
+	import { Alert } from '$lib/components/common'
+	import PathEditPen from '$lib/components/PathEditPen.svelte'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import Path from '$lib/components/Path.svelte'
+	import Label from '$lib/components/Label.svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { isOwner } from '$lib/utils'
+	import { userStore } from '$lib/stores'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+
+	interface Props {
+		/** The item's human name. Committed trimmed, like the bar's own field did. */
+		summary?: string
+		/** When false the summary is shown but not editable, for a host whose `customUi` says so. */
+		summaryEditable?: boolean
+		/** When false the path is shown but not editable, the same way. A host may allow one and
+		 *  refuse the other, and the popover offers whichever it is given. */
+		pathEditable?: boolean
+		path?: string
+		/** The item's *saved* path on the server, so the popover can say a rename needs deploying. */
+		savedPath?: string
+		/** Scopes the path picker's validation, and names the item in the placeholder and the
+		 *  deploy note. An agent lives at a resource path, so this is wider than the three
+		 *  workspace item kinds. */
+		kind?: ComponentProps<typeof Path>['kind']
+		/** Workspace the path picker scopes to; defaults to the operating workspace. */
+		workspaceId?: string
+		/** When set, warns that a redeploy happens on behalf of the current user instead. */
+		onBehalfOfEmail?: string | undefined
+		/** Only read when there is no `label`, where the pen is the whole trigger. */
+		penVisibility?: 'hover' | 'always'
+		/** The path as it was when the popover opened, undefined while it is closed. See the
+		 *  component note: the caller draws its trail from this so it holds still mid-rename. */
+		snapshotPath?: string | undefined
+		/** The item's name, rendered inside the trigger so clicking it opens the editor. Without
+		 *  one the trigger is a pen, for a host that draws its name somewhere this cannot reach. */
+		label?: Snippet
+		/** The trigger's own classes, for a host that needs it to wear the look of the row it sits
+		 *  in — the band's path segment. The default is a name with a hover fill behind it: the
+		 *  click opens an editor here rather than going anywhere, and the fill is what says the
+		 *  name is a control at all now that no pen sits beside it. */
+		triggerClass?: string
+		/** Which field takes the cursor on open. A popover anchored under the path opens on the
+		 *  path, one under the summary opens on the summary: the click says which half of the name
+		 *  the user came to change. `Path` autofocuses itself, so 'path' is the absence of a
+		 *  claim on the summary rather than a claim of its own. */
+		focusField?: 'summary' | 'path'
+		/** The path field's verdict, for a host that refuses to deploy while it is non-empty.
+		 *  A host whose item has a second path field has to bind both to the same slot, or
+		 *  whichever one is unmounted leaves its last verdict standing. */
+		error?: string
+	}
+
+	let {
+		summary = $bindable(),
+		summaryEditable = true,
+		pathEditable = true,
+		path = $bindable(),
+		savedPath,
+		kind = 'flow',
+		workspaceId,
+		onBehalfOfEmail,
+		penVisibility = 'hover',
+		label,
+		triggerClass = 'inline-flex items-center gap-1.5 min-w-0 max-w-full px-1 py-0.5 rounded cursor-pointer text-left hover:bg-surface-hover transition-colors',
+		focusField = 'summary',
+		snapshotPath = $bindable(),
+		error = $bindable()
+	}: Props = $props()
+
+	const penLabel = $derived(
+		summaryEditable && pathEditable
+			? 'Edit summary and path'
+			: summaryEditable
+				? 'Edit summary'
+				: 'Edit path'
+	)
+
+	// The popover's own state: a host opens this editor by clicking the name it handed over, so
+	// there is nothing for one to drive from outside.
+	let open = $state(false)
+
+	// Treat an empty path as ownable so the popover lets a user pick the path for a brand-new
+	// item. `Path.reset()` then synthesizes a default under their own user/folder scope.
+	const own = $derived(pathEditable && (!path || isOwner(path, actingUser, $operatingWorkspace)))
+
+	/** The path's name field inside this popover. `Path` hardcodes `id="path"`, and melt resolves a
+	 *  string `openFocus` with a document-wide `querySelector`, so a popover portalled to the body
+	 *  would hand the keystrokes to whichever other `Path` the page happens to have mounted. */
+	const pathField = () =>
+		document.querySelector<HTMLInputElement>('[data-path-edit-path] #path') ?? null
+
+	function setOpen(v: boolean) {
+		open = v
+		// Only snapshot when there is a path to freeze. A new flow or script opens with `path === ''`
+		// and relies on `Path.reset()` to seed one; snapshotting the empty value would leave the
+		// trail blank for the popover's whole lifetime.
+		snapshotPath = v && path ? path : undefined
+	}
+</script>
+
+<!-- `openFocus`: without naming the path's field melt lands on the row's first button, so a
+     popover opened from the path would not be typing into the path. -->
+<Popover
+	placement="bottom-start"
+	contentClasses="p-4"
+	class={triggerClass}
+	triggerAttrs={{ title: penLabel, 'aria-label': penLabel }}
+	usePointerDownOutside
+	excludeSelectors=".drawer"
+	disableFocusTrap
+	closeOnOtherPopoverOpen
+	openFocus={focusField === 'path'
+		? pathField
+		: summaryEditable
+			? '[data-path-edit-summary]'
+			: undefined}
+	bind:isOpen={() => open, setOpen}
+>
+	{#snippet trigger()}
+		{#if label}
+			<!-- The name is the affordance; a pen next to it would be a second one for the same
+			     click, and the band keeps its line quiet. -->
+			{@render label()}
+		{:else}
+			<PathEditPen label={penLabel} visibility={penVisibility} {open} />
+		{/if}
+	{/snippet}
+	{#snippet content()}
+		<div class="flex flex-col gap-6 w-[480px]">
+			<!-- The summary first: it is the name a reader sees, and the path below is where that
+			     name lives. -->
+			{#if summaryEditable}
+				<Label label="Summary">
+					<TextInput
+						bind:value={summary}
+						inputProps={{
+							placeholder: 'Add a summary...',
+							'data-path-edit-summary': '',
+							// The popover sits in a page that binds keys of its own (the editors all do),
+							// and a summary is prose — it must not reach them. Enter commits the line and
+							// closes, which is what a one-line field reads as; the path below is reached
+							// with Tab, not Enter.
+							onkeydown: (e: KeyboardEvent) => {
+								e.stopPropagation()
+								if (e.key === 'Enter') {
+									e.preventDefault()
+									summary = summary?.trim()
+									setOpen(false)
+								}
+							},
+							onblur: () => (summary = summary?.trim())
+						}}
+						size="sm"
+					/>
+				</Label>
+			{:else if summary}
+				<Label label="Summary">
+					<span class="text-xs text-secondary">{summary}</span>
+				</Label>
+			{/if}
+			{#if own}
+				<!-- Both of these say the same thing — the item's own saved path is not a collision —
+				     and both are needed, because `Path` skips the whole existence check while the
+				     typed path equals `initialPath`. Seeding that from the working path instead
+				     would make a rename to a taken path look untaken the moment the popover is
+				     reopened on it. With no saved path there is nothing the item occupies, so every
+				     path is checked. -->
+				<div data-path-edit-path>
+					<Path
+						autofocus
+						bind:path
+						bind:error
+						initialPath={savedPath ?? path ?? ''}
+						allowedExistingPath={savedPath}
+						checkInitialPathExistence={savedPath == undefined}
+						namePlaceholder={kind}
+						{kind}
+						size="sm"
+						drawerOffset={4000}
+						workspaceOverride={workspaceId}
+					/>
+				</div>
+				{#if savedPath && path && path !== savedPath}
+					<Alert
+						type="info"
+						size="xs"
+						title="Deploy the {kind} to make the path change effective."
+					/>
+				{/if}
+				{#if onBehalfOfEmail}
+					<Alert type="info" title="Run on behalf of" size="xs">
+						This flow will be redeployed on behalf of you ({$userStore?.email}) instead of {onBehalfOfEmail}
+					</Alert>
+				{/if}
+			{:else}
+				<Label label="Path">
+					<span class="text-xs font-mono text-secondary">{path}</span>
+					<p class="text-2xs text-tertiary mt-1">
+						{pathEditable
+							? 'Only the owner can change the path'
+							: 'This path cannot be changed here'}
+					</p>
+				</Label>
+			{/if}
+		</div>
+	{/snippet}
+</Popover>
diff --git a/frontend/src/lib/components/RunsPage.svelte b/frontend/src/lib/components/RunsPage.svelte
index ff32cbdbd7..72950dc53c 100644
--- a/frontend/src/lib/components/RunsPage.svelte
+++ b/frontend/src/lib/components/RunsPage.svelte
@@ -19,15 +19,7 @@
 		devopsRole,
 		enterpriseLicense
 	} from '$lib/stores'
-	import {
-		Button,
-		ButtonType,
-		Drawer,
-		DrawerContent,
-		Skeleton,
-		Tab,
-		Tabs
-	} from '$lib/components/common'
+	import { Button, Drawer, DrawerContent, Skeleton, Tab, Tabs } from '$lib/components/common'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import RunChart from '$lib/components/RunChart.svelte'
 
@@ -44,6 +36,8 @@
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
 	import RunsQueue from '$lib/components/runs/RunsQueue.svelte'
 	import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
 	import { pageHref, RUNS_PATH } from '$lib/components/sessions/previewPaths'
 	import { twMerge } from 'tailwind-merge'
 	import { computeJobKinds, useJobsLoader } from '$lib/components/runs/useJobsLoader.svelte'
@@ -609,8 +603,248 @@
 		openedRunId = undefined
 	}
 	let resolutionNote = $state('')
+	const phone = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR)
 </script>
 
+{#snippet runsHint()}
+	<Tooltip
+		documentationLink="https://www.windmill.dev/docs/core_concepts/monitor_past_and_future_runs"
+	>
+		All past and schedule executions of scripts and flows, including previews. You only see your own
+		runs or runs of groups you belong to unless you are an admin.
+	</Tooltip>
+{/snippet}
+
+{#snippet headerActions()}
+	<!-- The page's own row inside the band's actions box: these controls are denser than a page's
+	     two or three buttons, so they take a wider gap than the band's own. `flex-1 min-w-0` passes
+	     the band's flexibility down to the search field, the one control here that gives width
+	     back; the rest keep theirs or drop out of the row entirely at a width. -->
+	<div class="flex items-center gap-3 flex-1 min-w-0">
+		<!-- Always the icon form: the bar has room for two counters, never for the two labelled
+		     blocks. pr-2 on top of the row's own gap because the counts hang outside their icons,
+		     so without it the badge butts against the first filter.
+		     A phone's bar has room for the filter field and the timeframe and nothing else: the
+		     counters are a glance, and the same numbers are on the chart below. -->
+		<div class="flex items-center pr-2 {phone ? 'hidden' : ''}">
+			<RunsQueue
+				success={filters.val.status ?? null}
+				{queue_count}
+				{suspended_count}
+				onJobsWaiting={() => {
+					jobsFilter('waiting')
+				}}
+				onJobsSuspended={() => {
+					jobsFilter('suspended')
+				}}
+				small
+			/>
+		</div>
+		<!-- The two groups are the widest thing in the bar: they appear only once the bar is wide
+		     enough to hold them next to the search field, below which the same filtering is reachable
+		     from the search field's own `kind` and `status` chips. -->
+		<div class="hidden min-[1500px]:flex gap-2">
+			<ToggleButtonGroup
+				tabListClass="hidden min-[1500px]:flex"
+				bind:selected={
+					() => filters.val.job_kinds ?? 'runs',
+					(v) => (v === 'runs' ? delete filters.val.job_kinds : (filters.val.job_kinds = v))
+				}
+			>
+				{#snippet children({ item })}
+					<ToggleButton size="sm" value="all" label="All" {item} />
+					<ToggleButton
+						size="sm"
+						value="runs"
+						label="Runs"
+						tooltip="Runs are jobs that have no parent jobs (flows are jobs that are parent of the jobs they start), they have been triggered through the UI, a schedule or webhook"
+						{item}
+					/>
+					<ToggleButton
+						size="sm"
+						value="dependencies"
+						label="Deps"
+						tooltip="Deploying a script, flow or an app launch a dependency job that create and then attach the lockfile to the deployed item. This mechanism ensure that logic is always executed with the exact same direct and indirect dependencies."
+						{item}
+					/>
+					<ToggleButtonMore
+						small
+						hideSelectedOption={innerWidth < smallScreenWidth}
+						togglableItems={[
+							{
+								label: 'Previews',
+								value: 'previews',
+								tooltip: "Previews are jobs that have been started in the editor as 'Tests'"
+							},
+							{
+								label: 'Sync',
+								value: 'deploymentcallbacks',
+								tooltip:
+									'Sync jobs that are triggered on every script deployment to sync the workspace with the Git repository configured in the the workspace settings'
+							}
+						]}
+						{item}
+						bind:selected={filters.val.job_kinds}
+					/>
+				{/snippet}
+			</ToggleButtonGroup>
+			<ToggleButtonGroup
+				bind:selected={
+					() => filters.val.status ?? 'all',
+					(v) => (v === 'all' ? delete filters.val.status : (filters.val.status = v))
+				}
+				id="status"
+			>
+				{#snippet children({ item })}
+					<ToggleButton size="sm" value={'all'} label="All" {item} />
+					<ToggleButton
+						size="sm"
+						value={'running'}
+						tooltip="Running"
+						class="whitespace-nowrap"
+						icon={CirclePlay}
+						iconProps={{
+							class:
+								'group-data-[state=on]:text-yellow-600 dark:group-data-[state=on]:text-yellow-400'
+						}}
+						{item}
+					/>
+					<ToggleButton
+						size="sm"
+						value={'success'}
+						tooltip="Success"
+						class="whitespace-nowrap"
+						icon={CircleCheck}
+						iconProps={{
+							class:
+								'group-data-[state=on]:text-green-500 dark:group-data-[state=on]:text-green-300'
+						}}
+						{item}
+					/>
+					<ToggleButton
+						size="sm"
+						value={'failure'}
+						tooltip="Failure"
+						class="whitespace-nowrap"
+						icon={CircleAlert}
+						iconProps={{
+							class: 'group-data-[state=on]:text-red-500 dark:group-data-[state=on]:text-red-300'
+						}}
+						{item}
+					/>
+					<ToggleButton
+						size="sm"
+						value={'canceled'}
+						tooltip="Canceled"
+						class="whitespace-nowrap"
+						icon={Hourglass}
+						selectedColor="gray"
+						{item}
+					/>
+					{#if filters.val.status == 'waiting'}
+						<ToggleButton
+							size="sm"
+							value={'waiting'}
+							tooltip="Waiting"
+							class="whitespace-nowrap"
+							icon={Hourglass}
+							selectedColor="blue"
+							{item}
+						/>
+					{:else if filters.val.status == 'suspended'}
+						<ToggleButton
+							size="sm"
+							value={'suspended'}
+							tooltip="Suspended"
+							class="whitespace-nowrap"
+							icon={Hourglass}
+							selectedColor="purple"
+							{item}
+						/>
+					{/if}
+				{/snippet}
+			</ToggleButtonGroup>
+		</div>
+
+		<div class="hidden xl:flex gap-2 items-center">
+			{#if !filters.val.job_trigger_kind || filters.val.job_trigger_kind === '!schedule'}
+				<div class="flex items-center gap-1" title="Show schedules">
+					<Toggle
+						size="xs"
+						id="show-schedules"
+						bind:checked={
+							() => filters.val.job_trigger_kind !== '!schedule',
+							(v) =>
+								v
+									? delete filters.val.job_trigger_kind
+									: (filters.val.job_trigger_kind = '!schedule')
+						}
+					/>
+					<Calendar size={14} />
+				</div>
+			{/if}
+			<div class="flex items-center gap-1" title="Show future jobs">
+				<Toggle
+					size="xs"
+					id="show-future-jobs"
+					bind:checked={
+						() => filters.val.show_future_jobs !== false,
+						(v) =>
+							v ? delete filters.val.show_future_jobs : (filters.val.show_future_jobs = false)
+					}
+				/>
+				<Clock size={14} />
+			</div>
+		</div>
+
+		<!-- The one control in the band that gives way: everything else keeps the width it asked
+		     for, or drops out of the row at a width, and this takes what is left. -->
+		<FilterSearchbar
+			class={twMerge(
+				// A width of its own, and only ever less. As `flex-1` the field was whatever the row
+				// had left over, so a chip appearing or a filter committing resized it under the
+				// cursor and the last pixels came off the breadcrumb. 18rem is its width whenever the
+				// row fits, and it still shrinks when the row runs short, which is what keeps the row
+				// inside a box the bar lets shrink (`actionsFlexible`). `min-w-0` is what makes that
+				// shrink unconditional: a flex item's floor is its min-content width, which the chips
+				// inside the field raise, so without it a typed filter would push the field wider
+				// again exactly when the row has no room to give.
+				'relative w-[18rem] min-w-0 max-w-full',
+				// A phone's bar cannot spare that much before the timeframe beside it.
+				phone && 'w-[10rem]'
+			)}
+			schema={runsFilterSearchbarSchema}
+			presets={buildRunsFilterPresets({
+				isSuperAdminOrDevops: !!$superadmin || !!$devopsRole,
+				isAdminsWorkspace: $workspaceStore === 'admins'
+			})}
+			bind:value={filters.val}
+			placeholder="Filter runs..."
+			size="sm"
+			autofocus
+		/>
+		<TimeframeSelect
+			unifiedSize="sm"
+			onClick={() => jobsLoader?.loadJobs(true)}
+			loading={jobsLoader?.loading}
+			items={runsTimeframes}
+			bind:value={_timeframe.val}
+		/>
+		<!-- The filters are shallow-routed, so the search has to come off `window.location` at click
+		     time — `page.url` never sees them. Always the canonical `/runs`: only that is a recognized
+		     preview page, and the `/runs/<path>` route mirrors its path into `?path=` anyway. -->
+		<div class={phone ? 'hidden' : 'contents'}>
+			<OpenInSessionButton
+				source={{
+					page: () => pageHref(RUNS_PATH) + window.location.search,
+					workspaceId: $workspaceStore ?? undefined
+				}}
+				btnProps={{ unifiedSize: 'sm' }}
+			/>
+		</div>
+	</div>
+{/snippet}
+
 <ConfirmationModal
 	title={askingForConfirmation?.title ?? ''}
 	confirmationText={askingForConfirmation?.confirmBtnText ?? ''}
@@ -678,231 +912,10 @@
 		<p>Page not available for operators</p>
 	</div>
 {:else}
-	<div class="w-full h-screen flex flex-col" bind:clientWidth={innerWidth}>
-		<!-- Header and filters -->
-		<div id="runs-filters-bar" class="flex flex-row items-start w-full px-4 gap-3 py-4 flex-wrap">
-			<div class="flex flex-row items-center gap-6">
-				<h1
-					class={twMerge(
-						'!text-2xl font-semibold leading-6 tracking-tight',
-						$userStore?.operator ? 'pl-10' : ''
-					)}
-				>
-					Runs
-				</h1>
-
-				<Tooltip
-					documentationLink="https://www.windmill.dev/docs/core_concepts/monitor_past_and_future_runs"
-				>
-					All past and schedule executions of scripts and flows, including previews. You only see
-					your own runs or runs of groups you belong to unless you are an admin.
-				</Tooltip>
-
-				<!-- Queue -->
-				<RunsQueue
-					success={filters.val.status ?? null}
-					{queue_count}
-					{suspended_count}
-					onJobsWaiting={() => {
-						jobsFilter('waiting')
-					}}
-					onJobsSuspended={() => {
-						jobsFilter('suspended')
-					}}
-					small={innerWidth < smallScreenWidth}
-				/>
-			</div>
-
-			<div class="hidden xl:flex gap-2 ml-6">
-				<ToggleButtonGroup
-					tabListClass="hidden xl:flex"
-					bind:selected={
-						() => filters.val.job_kinds ?? 'runs',
-						(v) => (v === 'runs' ? delete filters.val.job_kinds : (filters.val.job_kinds = v))
-					}
-				>
-					{#snippet children({ item })}
-						<ToggleButton value="all" label="All" {item} />
-						<ToggleButton
-							value="runs"
-							label="Runs"
-							tooltip="Runs are jobs that have no parent jobs (flows are jobs that are parent of the jobs they start), they have been triggered through the UI, a schedule or webhook"
-							{item}
-						/>
-						<ToggleButton
-							value="dependencies"
-							label="Deps"
-							tooltip="Deploying a script, flow or an app launch a dependency job that create and then attach the lockfile to the deployed item. This mechanism ensure that logic is always executed with the exact same direct and indirect dependencies."
-							{item}
-						/>
-						<ToggleButtonMore
-							hideSelectedOption={innerWidth < smallScreenWidth}
-							togglableItems={[
-								{
-									label: 'Previews',
-									value: 'previews',
-									tooltip: "Previews are jobs that have been started in the editor as 'Tests'"
-								},
-								{
-									label: 'Sync',
-									value: 'deploymentcallbacks',
-									tooltip:
-										'Sync jobs that are triggered on every script deployment to sync the workspace with the Git repository configured in the the workspace settings'
-								}
-							]}
-							{item}
-							bind:selected={filters.val.job_kinds}
-						/>
-					{/snippet}
-				</ToggleButtonGroup>
-				<ToggleButtonGroup
-					bind:selected={
-						() => filters.val.status ?? 'all',
-						(v) => (v === 'all' ? delete filters.val.status : (filters.val.status = v))
-					}
-					id="status"
-				>
-					{#snippet children({ item })}
-						<ToggleButton value={'all'} label="All" {item} />
-						<ToggleButton
-							value={'running'}
-							tooltip="Running"
-							class="whitespace-nowrap"
-							icon={CirclePlay}
-							iconProps={{
-								class:
-									'group-data-[state=on]:text-yellow-600 dark:group-data-[state=on]:text-yellow-400'
-							}}
-							{item}
-						/>
-						<ToggleButton
-							value={'success'}
-							tooltip="Success"
-							class="whitespace-nowrap"
-							icon={CircleCheck}
-							iconProps={{
-								class:
-									'group-data-[state=on]:text-green-500 dark:group-data-[state=on]:text-green-300'
-							}}
-							{item}
-						/>
-						<ToggleButton
-							value={'failure'}
-							tooltip="Failure"
-							class="whitespace-nowrap"
-							icon={CircleAlert}
-							iconProps={{
-								class: 'group-data-[state=on]:text-red-500 dark:group-data-[state=on]:text-red-300'
-							}}
-							{item}
-						/>
-						<ToggleButton
-							value={'canceled'}
-							tooltip="Canceled"
-							class="whitespace-nowrap"
-							icon={Hourglass}
-							selectedColor="gray"
-							{item}
-						/>
-						{#if filters.val.status == 'waiting'}
-							<ToggleButton
-								value={'waiting'}
-								tooltip="Waiting"
-								class="whitespace-nowrap"
-								icon={Hourglass}
-								selectedColor="blue"
-								{item}
-							/>
-						{:else if filters.val.status == 'suspended'}
-							<ToggleButton
-								value={'suspended'}
-								tooltip="Suspended"
-								class="whitespace-nowrap"
-								icon={Hourglass}
-								selectedColor="purple"
-								{item}
-							/>
-						{/if}
-					{/snippet}
-				</ToggleButtonGroup>
-			</div>
-
-			<div class="hidden xl:flex gap-2 items-center min-h-8 ml-2">
-				{#if !filters.val.job_trigger_kind || filters.val.job_trigger_kind === '!schedule'}
-					<div class="flex items-center gap-1" title="Show schedules">
-						<Toggle
-							size="xs"
-							color="nord"
-							id="show-schedules"
-							bind:checked={
-								() => filters.val.job_trigger_kind !== '!schedule',
-								(v) =>
-									v
-										? delete filters.val.job_trigger_kind
-										: (filters.val.job_trigger_kind = '!schedule')
-							}
-						/>
-						<Calendar size={14} />
-					</div>
-				{/if}
-				<div class="flex items-center gap-1" title="Show future jobs">
-					<Toggle
-						size="xs"
-						color="nord"
-						id="show-future-jobs"
-						bind:checked={
-							() => filters.val.show_future_jobs !== false,
-							(v) =>
-								v ? delete filters.val.show_future_jobs : (filters.val.show_future_jobs = false)
-						}
-					/>
-					<Clock size={14} />
-				</div>
-			</div>
-
-			<TimeframeSelect
-				wrapperClasses="ml-auto"
-				onClick={() => jobsLoader?.loadJobs(true)}
-				loading={jobsLoader?.loading}
-				items={runsTimeframes}
-				bind:value={_timeframe.val}
-			/>
-			<!-- One flex item, so the session button never wraps to a row of its own. -->
-			<div class="flex flex-1 items-start justify-end gap-3">
-				<FilterSearchbar
-					class={twMerge(
-						'flex-1 relative min-w-[14rem]',
-						Object.keys(filters.val).length <= 3
-							? 'max-w-[20rem] 2xl:max-w-[28rem]'
-							: 'max-w-[34rem]',
-						ButtonType.UnifiedMinHeightClasses.md
-					)}
-					schema={runsFilterSearchbarSchema}
-					presets={buildRunsFilterPresets({
-						isSuperAdminOrDevops: !!$superadmin || !!$devopsRole,
-						isAdminsWorkspace: $workspaceStore === 'admins'
-					})}
-					bind:value={filters.val}
-					placeholder="Filter runs..."
-					autofocus
-				/>
-				<!-- The filters are shallow-routed, so the search has to come off
-				     `window.location` at click time — `page.url` never sees them. Always the
-				     canonical `/runs`: only that is a recognized preview page, and the
-				     `/runs/<path>` route mirrors its path into `?path=` anyway. -->
-				<!-- The button stretches to its parent's height, which is the whole header once
-				     this row wraps: pin it to one row's height. -->
-				<div class={twMerge('flex empty:hidden', ButtonType.UnifiedHeightClasses.md)}>
-					<OpenInSessionButton
-						source={{
-							page: () => pageHref(RUNS_PATH) + window.location.search,
-							workspaceId: $workspaceStore ?? undefined
-						}}
-						btnProps={{ unifiedSize: 'md' }}
-					/>
-				</div>
-			</div>
-		</div>
+	<div class="w-full h-full flex flex-col" bind:clientWidth={innerWidth}>
+		<!-- `actionsFlexible`: the filter row holds a search field that can give width back, so the
+		     bar lets this box shrink on a phone instead of holding its content width. -->
+		<PageHeaderContent afterName={runsHint} actions={headerActions} actionsFlexible />
 
 		<!-- Graph -->
 		<div id="runs-chart" class="p-2 px-4 bg-surface-tertiary mx-4 border rounded-md">
diff --git a/frontend/src/lib/components/ScriptBuilder.svelte b/frontend/src/lib/components/ScriptBuilder.svelte
index 62f9851fcc..f69cf37f1d 100644
--- a/frontend/src/lib/components/ScriptBuilder.svelte
+++ b/frontend/src/lib/components/ScriptBuilder.svelte
@@ -93,8 +93,11 @@
 	import { writable } from 'svelte/store'
 	import { defaultScriptLanguages, processLangs } from '$lib/scripts'
 	import DefaultScripts from './DefaultScripts.svelte'
-	import { getContext, onDestroy, onMount, setContext, tick, untrack } from 'svelte'
+	import { getContext, onDestroy, onMount, setContext, tick, untrack, type Snippet } from 'svelte'
 	import EditorHeader from './EditorHeader.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
 	import ScriptSettingsBadges from './ScriptSettingsBadges.svelte'
 	import Badge from './common/badge/Badge.svelte'
 	import Modal from './common/modal/Modal.svelte'
@@ -162,12 +165,14 @@
 		loadedFromDraft = false,
 		othersDraftsCount = 0,
 		onOpenOthersDrafts,
-		condensedHeader = false
+		condensedHeader = false,
+		ownsPageHeader = false
 	}: ScriptBuilderProps = $props()
 
 	// Top-bar button size + bar height. Condensed (session preview) uses the
 	// smallest well-supported unified size (`sm`) so the bar is thinner.
-	const headerBtnSize = $derived(condensedHeader ? 'sm' : 'md')
+	// In the page header the buttons ride a 44px band, which takes the same size.
+	const headerBtnSize = $derived(condensedHeader || ownsPageHeader ? 'sm' : 'md')
 
 	export function getInitialAndModifiedValues(): SavedAndModifiedValue {
 		return {
@@ -196,8 +201,24 @@
 	// right group (hide the ~200px tag select, icon-only Diff/Settings) before the
 	// full group crowds the path into heavy truncation; ~900 is where the path
 	// keeps a usable width given the right group's natural ~440px.
+	/** Held by the rename popover while it is open; the band's trail reads it so the path does not
+	 *  reflow under the pointer as the user types. */
+	let pathSnapshot = $state<string | undefined>(undefined)
+
 	let topbarWidth = $state(0)
-	const compactTopbar = $derived(topbarWidth > 0 && topbarWidth < 900)
+	// In the page header the buttons share the row with the breadcrumb, so they collapse sooner:
+	// the trail and the summary take ~560px before either truncates, and the full button group is
+	// ~515px — about 1100px between them, plus slack for a longer path than most.
+	const compactBelow = $derived(ownsPageHeader ? 1200 : 900)
+	const compactTopbar = $derived.by(() => {
+		const w = ownsPageHeader ? pageHeader.barWidth : topbarWidth
+		return w > 0 && w < compactBelow
+	})
+	// A phone's bar holds the trail and one button. Diff and Settings join the menu that compact
+	// already shows, and Deploy stays out: it is what this page is for.
+	const phoneTopbar = $derived(
+		ownsPageHeader && pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR
+	)
 
 	// The workspace this editor operates on: deploy, save-draft, trigger loading
 	// and the AutosaveIndicator all target it. Falls back to the full-page
@@ -220,7 +241,21 @@
 
 	function getCompactMenuItems(): Item[] {
 		const hasTags = (scriptWorkerTags?.length ?? 0) > 0
+		const isDraftOnly = savedScript?.no_deployed === true
 		return [
+			...(phoneTopbar && customUi?.topBar?.diff != false
+				? [
+						{
+							displayName: 'Diff',
+							icon: DiffIcon,
+							disabled: !savedScript || !diffDrawer || isDraftOnly,
+							action: () => openDiffDrawer()
+						}
+					]
+				: []),
+			...(phoneTopbar && customUi?.topBar?.settings != false
+				? [{ displayName: 'Settings', icon: Settings, action: () => (metadataOpen = true) }]
+				: []),
 			...(customUi?.topBar?.tagEdit != false && hasTags
 				? [
 						{
@@ -561,6 +596,7 @@
 			| 'powershell'
 			| 'bunnative'
 			| 'claudesandbox'
+			| 'pisandbox'
 			| 'wac_python'
 			| 'wac_typescript'
 			| 'ci_test_bun'
@@ -1508,10 +1544,12 @@
 														(lang == script.language &&
 															template != 'bunnative' &&
 															template != 'docker' &&
-															template != 'claudesandbox') ||
+															template != 'claudesandbox' &&
+															template != 'pisandbox') ||
 														(template == 'bunnative' && lang == 'bunnative') ||
 														(template == 'docker' && lang == 'docker') ||
-														(template == 'claudesandbox' && lang == 'bun')}
+														((template == 'claudesandbox' || template == 'pisandbox') &&
+															lang == 'bun')}
 													<Popover
 														disablePopup={!enterpriseLangs.includes(lang) || !!$enterpriseLicense}
 													>
@@ -1562,6 +1600,21 @@
 										>
 											Claude Sandbox
 										</Button>
+										<Button
+											unifiedSize="xs"
+											variant="default"
+											startIcon={{
+												icon: LanguageIcon,
+												props: { lang: 'pisandbox', width: 16, height: 16 }
+											} as ButtonType.Icon}
+											onclick={() => {
+												template = 'pisandbox'
+												script.language = 'bun'
+												initContent('bun', script.kind, template)
+											}}
+										>
+											Pi Sandbox
+										</Button>
 										<span title="Workflow-as-Code">
 											<Button
 												size="xs2"
@@ -2249,164 +2302,298 @@
 	</Drawer>
 
 	<div class="flex flex-col h-full">
-		<div
-			bind:clientWidth={topbarWidth}
-			class="flex items-center px-4 {condensedHeader ? 'h-9' : 'h-12'}"
-		>
-			<div class="flex gap-2 lg:gap-2 w-full items-center">
-				<div class="flex flex-row items-center gap-2 min-w-0 shrink">
-					<button
-						disabled={customUi?.topBar?.settings == false}
-						class="shrink-0"
-						onclick={async () => {
-							metadataOpen = true
-						}}
-					>
-						<LanguageIcon lang={script.language} size={condensedHeader ? 18 : 24} />
-					</button>
-					{#if customUi?.topBar?.path != false}
-						<div class="min-w-0 overflow-hidden">
-							<EditorHeader
-								bind:summary={script.summary}
-								bind:path={script.path}
-								savedPath={initialPath}
-								kind="script"
-								summaryEditable={customUi?.topBar?.editableSummary != false}
-								pathEditable={customUi?.topBar?.editablePath != false}
-								hidePath={condensedHeader}
-								workspaceId={autosaveWorkspace}
-								onNavigate={(item) => onNavigate?.(item)}
-							/>
-						</div>
+		{#if ownsPageHeader}
+			<!-- The editor's own top bar is the page header on this route: the script's path and
+			     summary are the breadcrumb's, and its buttons are the header's actions. -->
+			<!-- `separator="none"`: the toolbar right below the bar draws its own `border-b`, and the
+			     bar's edge would be a second line on top of it. -->
+			<PageHeaderContent
+				item={{
+					// Frozen while the rename popover is open so the trail holds still as the user types.
+					kind: 'script',
+					// `script?`: this object is built inside a getter the band evaluates from its own
+					// tree, and `script` is a bindable prop. Deploying a new script clears the draft the
+					// route binds here and drops the `{#if}` around this editor in one flush, which
+					// invalidates the band before this component is torn down.
+					path: pathSnapshot ?? script?.path,
+					summaryContent: scriptSummary,
+					// Gated like the summary's own editor: a host that allows neither field keeps the
+					// band's segment, which copies the path.
+					pathTrigger:
+						customUi?.topBar?.editablePath != false || customUi?.topBar?.editableSummary != false
+							? scriptPathTrigger
+							: undefined
+				}}
+				afterName={scriptMarks}
+				actions={scriptHeaderActions}
+				separator="none"
+			/>
+		{:else}
+			<div
+				bind:clientWidth={topbarWidth}
+				class="flex items-center px-4 {condensedHeader ? 'h-9' : 'h-12'}"
+			>
+				<div class="flex gap-2 lg:gap-2 w-full items-center">
+					<div class="flex flex-row items-center gap-2 min-w-0 shrink">
+						{@render languageButton(condensedHeader ? 18 : 24)}
+						{#if customUi?.topBar?.path != false}
+							<div class="min-w-0 overflow-hidden">
+								<EditorHeader
+									bind:summary={script.summary}
+									bind:path={script.path}
+									savedPath={initialPath}
+									kind="script"
+									summaryEditable={customUi?.topBar?.editableSummary != false}
+									pathEditable={customUi?.topBar?.editablePath != false}
+									hidePath={condensedHeader}
+									workspaceId={autosaveWorkspace}
+									onNavigate={(item) => onNavigate?.(item)}
+								/>
+							</div>
+						{/if}
+						{@render autosaveIndicator()}
+						{#if !condensedHeader}
+							{@render settingsBadges()}
+						{/if}
+					</div>
+
+					<!-- Separator -->
+					<div class="flex-1"></div>
+
+					{#if $enterpriseLicense && initialPath != '' && !inSessionPane}
+						<Awareness />
 					{/if}
-					{#if opWorkspace}
-						<AutosaveIndicator
-							workspace={opWorkspace}
-							itemKind="script"
-							path={indicatorPath}
-							draftOnly={savedScript?.no_deployed === true}
-							{onResetToDeployed}
-							{loadedFromDraft}
-							{othersDraftsCount}
-							{onOpenOthersDrafts}
-						/>
-					{/if}
-					{#if !condensedHeader}
-						{@const canOpenRuntime =
-							customUi?.topBar?.settings != false &&
-							customUi?.settingsPanel?.disableRuntime !== true}
-						<ScriptSettingsBadges
-							settings={script}
-							onclick={canOpenRuntime
-								? () => {
-										selectedTab = 'runtime'
-										metadataOpen = true
-									}
-								: undefined}
+
+					<!-- Separator -->
+					<div class="flex-1"></div>
+
+					{@render rightButtons()}
+				</div>
+			</div>
+		{/if}
+
+		{#snippet scriptSummary()}
+			<!-- Everything the band pulls from this editor is gated on `script`. It is a bindable prop,
+			     and these snippets render from the band's tree, where nothing orders the route clearing
+			     that prop against this component's teardown: deploying a new script discards the draft
+			     bound here and drops the `{#if}` around this editor in the same flush. -->
+			{#if script}
+				<!-- Not edited in place: clicking the name opens the summary and the path together, so
+				     the band reads as a name rather than a form. `title` for one it truncates. -->
+				<div class="flex items-center gap-1 min-w-0">
+					{#snippet summaryText()}
+						<span
+							class="min-w-0 truncate text-xs {emptyString(script.summary)
+								? 'text-tertiary italic font-normal'
+								: 'font-medium text-emphasis'}"
+							title={script.summary}
+							>{emptyString(script.summary) ? 'Add a summary...' : script.summary}</span
+						>
+					{/snippet}
+					{#if customUi?.topBar?.editablePath != false || customUi?.topBar?.editableSummary != false}
+						<PathEditPopover
+							label={summaryText}
+							bind:summary={script.summary}
+							summaryEditable={customUi?.topBar?.editableSummary != false}
+							pathEditable={customUi?.topBar?.editablePath != false}
+							bind:path={script.path}
+							bind:snapshotPath={pathSnapshot}
+							savedPath={initialPath}
+							kind="script"
+							workspaceId={autosaveWorkspace}
 						/>
+					{:else}
+						{@render summaryText()}
 					{/if}
 				</div>
+			{/if}
+		{/snippet}
 
-				<!-- Separator -->
-				<div class="flex-1"></div>
+		<!-- The same editor as the summary's, hung off the band's path segment: anchored there it
+		     opens under the path, and `focusField` puts the cursor in the field that half of the
+		     name belongs to. The bindings are written out again because `bind:` cannot be spread;
+		     both instances bind the same slots, and only one is ever open. -->
+		{#snippet scriptPathTrigger(pathLabel: Snippet, triggerClass: string)}
+			<!-- Gated like the summary beside it: `script` is a bindable prop the route can clear in
+			     the same flush that drops this editor, and this renders from the band's tree. The
+			     `{:else}` is not decoration: the band hands the segment over the moment a page offers
+			     a `pathTrigger`, so a gate that drew nothing would take the path off the trail. -->
+			{#if script}
+				<PathEditPopover
+					label={pathLabel}
+					{triggerClass}
+					focusField="path"
+					bind:summary={script.summary}
+					summaryEditable={customUi?.topBar?.editableSummary != false}
+					pathEditable={customUi?.topBar?.editablePath != false}
+					bind:path={script.path}
+					bind:snapshotPath={pathSnapshot}
+					savedPath={initialPath}
+					kind="script"
+					workspaceId={autosaveWorkspace}
+				/>
+			{:else}
+				<span class={triggerClass}>{@render pathLabel()}</span>
+			{/if}
+		{/snippet}
 
+		{#snippet scriptMarks()}
+			{#if script}
+				<!-- Concurrency, cache, a dedicated worker: settings that hold whatever the editor shows,
+				     so they belong with the script's name. The language icon the editor's own bar carried
+				     does not come along — the code under it says which language this is. -->
+				{@render settingsBadges('pl-1.5')}
+			{/if}
+		{/snippet}
+
+		{#snippet scriptHeaderActions()}
+			{#if script}
+				<!-- Saving state and other people's drafts: the editor's own bar carries them beside the
+				     path, so the header has to carry them when it owns the bar — without them a
+				     full-page editor saves with no word either way. -->
+				{@render autosaveIndicator()}
 				{#if $enterpriseLicense && initialPath != '' && !inSessionPane}
 					<Awareness />
 				{/if}
+				{@render rightButtons()}
+			{/if}
+		{/snippet}
 
-				<!-- Separator -->
-				<div class="flex-1"></div>
+		{#snippet languageButton(size: number)}
+			<button
+				disabled={customUi?.topBar?.settings == false}
+				class="shrink-0"
+				title="Settings"
+				onclick={async () => {
+					metadataOpen = true
+				}}
+			>
+				<LanguageIcon lang={script.language} {size} />
+			</button>
+		{/snippet}
 
-				{#snippet settingsButton()}
-					{#if customUi?.topBar?.settings != false}
-						<Button
-							aiId="script-builder-settings"
-							aiDescription="Script builder settings to configure metadata, runtime, triggers, and generated UI."
-							variant="default"
-							unifiedSize={headerBtnSize}
-							on:click={() => (metadataOpen = true)}
-							startIcon={{ icon: Settings }}
-							iconOnly={compactTopbar}
-							title="Settings"
-						>
-							<span> Settings </span>
-						</Button>
-					{/if}
-				{/snippet}
-				{#snippet diffButton()}
-					{#if customUi?.topBar?.diff != false}
-						{@const isDraftOnly = savedScript?.no_deployed === true}
-						{@const diffDisabled = !savedScript || !diffDrawer || isDraftOnly}
-						{@const diffTitle = isDraftOnly
-							? 'Deploy this script once to compare against the deployed version'
-							: 'Diff'}
-						<!-- A disabled <button> fires no pointer events, so a title/tooltip on it
+		{#snippet autosaveIndicator()}
+			{#if opWorkspace}
+				<AutosaveIndicator
+					workspace={opWorkspace}
+					itemKind="script"
+					path={indicatorPath}
+					draftOnly={savedScript?.no_deployed === true}
+					{onResetToDeployed}
+					{loadedFromDraft}
+					{othersDraftsCount}
+					{onOpenOthersDrafts}
+				/>
+			{/if}
+		{/snippet}
+
+		{#snippet settingsBadges(className?: string)}
+			{@const canOpenRuntime =
+				customUi?.topBar?.settings != false && customUi?.settingsPanel?.disableRuntime !== true}
+			<ScriptSettingsBadges
+				class={className}
+				settings={script}
+				onclick={canOpenRuntime
+					? () => {
+							selectedTab = 'runtime'
+							metadataOpen = true
+						}
+					: undefined}
+			/>
+		{/snippet}
+
+		{#snippet rightButtons()}
+			{#snippet settingsButton()}
+				{#if customUi?.topBar?.settings != false}
+					<Button
+						aiId="script-builder-settings"
+						aiDescription="Script builder settings to configure metadata, runtime, triggers, and generated UI."
+						variant="default"
+						unifiedSize={headerBtnSize}
+						on:click={() => (metadataOpen = true)}
+						startIcon={{ icon: Settings }}
+						iconOnly={compactTopbar}
+						title="Settings"
+					>
+						<span> Settings </span>
+					</Button>
+				{/if}
+			{/snippet}
+			{#snippet diffButton()}
+				{#if customUi?.topBar?.diff != false}
+					{@const isDraftOnly = savedScript?.no_deployed === true}
+					{@const diffDisabled = !savedScript || !diffDrawer || isDraftOnly}
+					{@const diffTitle = isDraftOnly
+						? 'Deploy this script once to compare against the deployed version'
+						: 'Diff'}
+					<!-- A disabled <button> fires no pointer events, so a title/tooltip on it
 						     never shows on hover. pointer-events-none on the button lets the hover
 						     reach this titled wrapper instead. -->
-						<div title={diffTitle} class={diffDisabled ? 'flex cursor-not-allowed' : 'flex'}>
-							<Button
-								variant="default"
-								unifiedSize={headerBtnSize}
-								on:click={() => openDiffDrawer()}
-								disabled={diffDisabled}
-								btnClasses={diffDisabled ? 'pointer-events-none' : undefined}
-								iconOnly={compactTopbar}
-								title={diffTitle}
-								startIcon={{ icon: DiffIcon }}
-							>
-								Diff
-							</Button>
-						</div>
-					{/if}
-				{/snippet}
-				{#if compactTopbar}
-					<DropdownV2 items={getCompactMenuItems} placement="bottom-end">
-						{#snippet buttonReplacement()}
-							<Button
-								nonCaptureEvent
-								unifiedSize={headerBtnSize}
-								variant="subtle"
-								startIcon={{ icon: EllipsisVertical }}
-								iconOnly
-								title="More"
-							/>
-						{/snippet}
-					</DropdownV2>
+					<div title={diffTitle} class={diffDisabled ? 'flex cursor-not-allowed' : 'flex'}>
+						<Button
+							variant="default"
+							unifiedSize={headerBtnSize}
+							on:click={() => openDiffDrawer()}
+							disabled={diffDisabled}
+							btnClasses={diffDisabled ? 'pointer-events-none' : undefined}
+							iconOnly={compactTopbar}
+							title={diffTitle}
+							startIcon={{ icon: DiffIcon }}
+						>
+							Diff
+						</Button>
+					</div>
+				{/if}
+			{/snippet}
+			{#if compactTopbar}
+				<DropdownV2 items={getCompactMenuItems} placement="bottom-end">
+					{#snippet buttonReplacement()}
+						<Button
+							nonCaptureEvent
+							unifiedSize={headerBtnSize}
+							variant="subtle"
+							startIcon={{ icon: EllipsisVertical }}
+							iconOnly
+							title="More"
+						/>
+					{/snippet}
+				</DropdownV2>
+				{#if !phoneTopbar}
 					{@render diffButton()}
 					{@render settingsButton()}
-				{:else}
-					{@render diffButton()}
-					{#if customUi?.topBar?.tagEdit != false}
-						{#if scriptWorkerTags}
-							{#if scriptWorkerTags?.length ?? 0 > 0}
-								<div class="max-w-[200px]">
-									<WorkerTagSelect
-										nullTag={script.language}
-										placeholder={customUi?.tagSelectPlaceholder}
-										bind:tag={script.tag}
-										size={headerBtnSize}
-										workspaceId={opWorkspace}
-									/>
-								</div>
-							{/if}
-						{/if}
-					{/if}
-					{@render settingsButton()}
 				{/if}
+			{:else}
+				{@render diffButton()}
+				{#if customUi?.topBar?.tagEdit != false}
+					{#if scriptWorkerTags}
+						{#if scriptWorkerTags?.length ?? 0 > 0}
+							<div class="max-w-[200px]">
+								<WorkerTagSelect
+									nullTag={script.language}
+									placeholder={customUi?.tagSelectPlaceholder}
+									bind:tag={script.tag}
+									size={headerBtnSize}
+									workspaceId={opWorkspace}
+								/>
+							</div>
+						{/if}
+					{/if}
+				{/if}
+				{@render settingsButton()}
+			{/if}
 
-				<DeployButton
-					loading={!fullyLoaded}
-					{loadingSave}
-					unifiedSize={headerBtnSize}
-					dropdownItems={computeDropdownItems(initialPath, savedScript)}
-					on:save={({ detail }) => handleEditScript(false, detail)}
-				/>
-			</div>
-		</div>
+			<DeployButton
+				loading={!fullyLoaded}
+				{loadingSave}
+				unifiedSize={headerBtnSize}
+				dropdownItems={computeDropdownItems(initialPath, savedScript)}
+				on:save={({ detail }) => handleEditScript(false, detail)}
+			/>
+		{/snippet}
 
 		{#if showPipelineHint}
 			<div
-				class="flex items-center gap-2 px-4 py-1 border-y bg-surface-secondary text-xs text-secondary"
+				class="flex items-center gap-2 px-4 py-1 border-b bg-surface-secondary text-xs text-secondary"
 			>
 				<Network size={14} class="shrink-0 text-tertiary" />
 				<span class="truncate">
diff --git a/frontend/src/lib/components/ScriptEditor.svelte b/frontend/src/lib/components/ScriptEditor.svelte
index 1cabcf8265..8e60d40f72 100644
--- a/frontend/src/lib/components/ScriptEditor.svelte
+++ b/frontend/src/lib/components/ScriptEditor.svelte
@@ -150,6 +150,7 @@
 			| 'powershell'
 			| 'bunnative'
 			| 'claudesandbox'
+			| 'pisandbox'
 			| 'wac_python'
 			| 'wac_typescript'
 			| 'ci_test_bun'
@@ -2100,43 +2101,15 @@
 							</div>
 						{/if}
 						{#if customUi?.previewPanel?.hideArgs}
-							<!-- Compact preview layout used by the pipeline editor:
-						     no args column (the script is known to take no
-						     inputs), LogPanel takes the full width, with a
-						     small Test/Cancel button at the top-left of the
-						     preview band. The earlier `-translate-y-1/2`
-						     "float onto the editor" version was clipped in
-						     Firefox (transform + overflow: visible interaction
-						     on the parent splitpane Pane), so the button is
-						     now positioned inside the panel — `top-1` keeps
-						     it visually pinned to the top edge without
-						     relying on cross-browser overflow behaviour. -->
-							<div class="relative h-full pt-9 flex flex-col">
-								{#if testJob?.id && testJob.type === 'CompletedJob' && opWs}
-									<!-- Right-side affordances when we're displaying a *completed*
-									     job (either the user just ran a test, or the on-mount
-									     last-run loader populated the panel). The job-id link
-									     opens the full run page in a new tab; the dispatch
-									     button mounts a popover that shows what downstream
-									     jobs this run triggered (rendered only when the run
-									     actually dispatched anything). -->
-									<div class="absolute top-1 right-2 z-10 flex items-center gap-2">
-										<a
-											class="text-3xs text-blue-600 hover:underline font-mono"
-											href={`${base}/run/${testJob.id}?workspace=${opWs}`}
-											target="_blank"
-											rel="noopener noreferrer"
-											title="Open this run"
-										>
-											{testJob.id.slice(0, 8)}… ↗
-										</a>
-										<DispatchEventsButton
-											workspace={testJob.workspace_id ?? opWs}
-											jobId={testJob.id}
-										/>
-									</div>
-								{/if}
-								<div class="absolute top-1 left-2 z-10">
+							<!-- Compact preview layout used by the pipeline editor: no args
+							     column (most pipeline scripts take no inputs) and a full-width
+							     LogPanel. The controls sit in normal flow rather than floating
+							     onto the editor band, which Firefox clipped (transform +
+							     overflow: visible on the parent splitpane Pane). -->
+							<div class="h-full flex flex-col">
+								<!-- Test sits at the top right, the last run's link under it. -->
+								<div class="shrink-0 flex flex-col items-end gap-1 px-2 pt-2 pb-1">
+								<div>
 									{#if testIsLoading}
 										{@render cancelTestButton('sm', 'shadow-md')}
 									{:else if (customUi?.previewPanel?.downstreamSubscribers ?? 0) > 0 || customUi?.previewPanel?.onBoundedRun}
@@ -2270,6 +2243,31 @@
 										{@render runTestButton('sm', 'shadow-md')}
 									{/if}
 								</div>
+								{#if testJob?.id && testJob.type === 'CompletedJob' && opWs}
+									<!-- Right-side affordances when we're displaying a *completed*
+									     job (either the user just ran a test, or the on-mount
+									     last-run loader populated the panel). The job-id link
+									     opens the full run page in a new tab; the dispatch
+									     button mounts a popover that shows what downstream
+									     jobs this run triggered (rendered only when the run
+									     actually dispatched anything). -->
+									<div class="flex items-center gap-2">
+										<a
+											class="text-3xs text-blue-600 hover:underline font-mono"
+											href={`${base}/run/${testJob.id}?workspace=${opWs}`}
+											target="_blank"
+											rel="noopener noreferrer"
+											title="Open this run"
+										>
+											{testJob.id.slice(0, 8)}… ↗
+										</a>
+										<DispatchEventsButton
+											workspace={testJob.workspace_id ?? opWs}
+											jobId={testJob.id}
+										/>
+									</div>
+								{/if}
+								</div>
 								{#if customUi?.previewPanel?.argsAboveLogs && schema?.properties && Object.keys(schema.properties).length > 0}
 									<div
 										class="shrink-0 overflow-auto max-h-[45%] border-b border-gray-200 dark:border-gray-700 px-4 py-3"
diff --git a/frontend/src/lib/components/ScriptSettingsBadges.svelte b/frontend/src/lib/components/ScriptSettingsBadges.svelte
index 8d73609891..7d09bce459 100644
--- a/frontend/src/lib/components/ScriptSettingsBadges.svelte
+++ b/frontend/src/lib/components/ScriptSettingsBadges.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import { twMerge } from 'tailwind-merge'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Popover from '$lib/components/Popover.svelte'
 	import {
@@ -12,15 +13,18 @@
 		// (e.g. to open the settings drawer focused on that section).
 		onclick?: (key: string) => void
 		small?: boolean
+		/** On the row that holds the badges — so a script with none of these settings leaves no
+		 * gap where they would have been. */
+		class?: string
 	}
 
-	let { settings, onclick, small = true }: Props = $props()
+	let { settings, onclick, small = true, class: className = '' }: Props = $props()
 
 	let badges = $derived(getActiveScriptSettingsBadges(settings))
 </script>
 
 {#if badges.length > 0}
-	<div class="flex flex-row flex-wrap gap-1 items-center">
+	<div class={twMerge('flex flex-row flex-wrap gap-1 items-center', className)}>
 		{#each badges as badge (badge.key)}
 			<!-- Icon-only chips to save space in crowded top bars; the label and current
 				value are shown in the hover popover. -->
diff --git a/frontend/src/lib/components/ServiceLogsInner.svelte b/frontend/src/lib/components/ServiceLogsInner.svelte
index 85c6cf7fb9..03cd5bf676 100644
--- a/frontend/src/lib/components/ServiceLogsInner.svelte
+++ b/frontend/src/lib/components/ServiceLogsInner.svelte
@@ -10,8 +10,10 @@
 	import Toggle from './Toggle.svelte'
 	import TextInput from './text_input/TextInput.svelte'
 	import Popover from './Popover.svelte'
+	// The clickable one, for the folded switches; the import above is the hover tooltip.
+	import MeltPopover from './meltComponents/Popover.svelte'
 	import { sendUserToast } from '$lib/toast'
-	import { onDestroy, tick, type Snippet } from 'svelte'
+	import { onDestroy, tick } from 'svelte'
 	import { fade } from 'svelte/transition'
 	import {
 		AlertTriangle,
@@ -22,7 +24,8 @@
 		Loader2,
 		ScrollText,
 		Search,
-		SearchX
+		SearchX,
+		SlidersHorizontal
 	} from 'lucide-svelte'
 	import { copyToClipboard, scroll_into_view_if_needed_polyfill, truncateRev } from '$lib/utils'
 	import LogSnippetViewer from './LogSnippetViewer.svelte'
@@ -33,15 +36,24 @@
 	import { goto } from '$lib/navigation'
 	import { page } from '$app/state'
 	import { watch } from 'runed'
+	import Tooltip from './Tooltip.svelte'
+	import PageHeaderContent from './PageHeaderContent.svelte'
+	import { pageHeader } from './pageHeaderRegistry.svelte'
 
 	interface Props {
 		searchTerm: string
 		tagLabel?: string
-		/** Rendered at the start of the toolbar row, so the page title shares it. */
-		title?: Snippet
 	}
 
-	let { searchTerm = $bindable(), tagLabel, title }: Props = $props()
+	let { searchTerm = $bindable(), tagLabel }: Props = $props()
+
+	/** Bar width below which the two switches fold into a popover. Measured: the breadcrumb takes
+	 *  ~360, the search field asks for 384 and the timeframe 223, so under this the field is what
+	 *  would start giving width back — and it is the control the page exists for. */
+	const COMPACT_SWITCHES_BAR = 1200
+	const compactSwitches = $derived(
+		pageHeader.barWidth > 0 && pageHeader.barWidth < COMPACT_SWITCHES_BAR
+	)
 
 	let queryParseErrors: string[] | undefined = $state(undefined)
 
@@ -692,88 +704,135 @@
 	</DrawerContent>
 </Drawer>
 
-<div class="flex flex-col grow min-h-0 min-w-0 gap-2 pb-2">
-	<div class="flex flex-wrap items-center gap-x-4 gap-y-2 pt-4 pb-2">
-		{@render title?.()}
-		<div class="relative grow min-w-64">
-			<Search
-				size={16}
-				class="absolute left-2 top-1/2 -translate-y-1/2 text-hint pointer-events-none z-10"
-			/>
-			<TextInput
-				bind:value={searchTerm}
-				size="md"
-				class="pl-8 pr-8"
-				inputProps={{
-					id: 'quickSearchInput',
-					placeholder: 'Search service logs',
-					autocomplete: 'off',
-					autofocus: true
-				}}
-			/>
-			{#if searchTerm !== '' && queryParseErrors && queryParseErrors.length > 0}
-				<div class="absolute right-2 top-1/2 -translate-y-1/2 z-10 flex">
-					<Popover notClickable placement="bottom-end">
-						<AlertTriangle size={16} class="text-yellow-500" />
-						{#snippet text()}
-							<div class="flex flex-col gap-1 text-xs">
-								<span>Some search terms were ignored because they could not be parsed:</span>
-								<ul class="list-disc pl-4">
-									{#each queryParseErrors ?? [] as msg}
-										<li>{msg}</li>
-									{/each}
-								</ul>
-							</div>
-						{/snippet}
-					</Popover>
-				</div>
-			{/if}
-		</div>
-		<TimeframeSelect
-			items={serviceLogsTimeframes}
-			bind:value={timeframe}
-			{loading}
-			wrapperClasses="w-64"
-			onClick={() => {
-				minTs = undefined
-				maxTs = undefined
-				allLogs = undefined
-				const ts = timeframe.computeMinMax()
-				getAllLogs(ts.minTs ?? undefined, ts.maxTs ?? undefined)
+{#snippet serviceLogsHint()}
+	<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/service_logs">
+		Logs written by the servers, workers and indexers of this instance, grouped by host.
+	</Tooltip>
+{/snippet}
+
+{#snippet serviceLogsActions()}
+	<!-- The widest control here, because searching is what the page is for. It is also the one that
+	     gives width back when the bar is tight — that is what `actionsFlexible` on the registration
+	     asks the bar to allow — down to a floor that still fits a query worth reading. -->
+	<div class="relative w-96 min-w-40 shrink">
+		<Search
+			size={16}
+			class="absolute left-2 top-1/2 -translate-y-1/2 text-hint pointer-events-none z-10"
+		/>
+		<TextInput
+			bind:value={searchTerm}
+			size="sm"
+			class="pl-8 pr-8"
+			inputProps={{
+				id: 'quickSearchInput',
+				placeholder: 'Search service logs',
+				autocomplete: 'off',
+				autofocus: true
 			}}
 		/>
-		<div class="flex items-center gap-4">
-			<Toggle
-				size="sm"
-				bind:checked={withError}
-				options={{
-					right: 'With errors only',
-					rightTooltip: 'Only list the log files that contain at least one error line'
-				}}
-				on:change={() => {
-					allLogs = undefined
-					getAllLogs(minTs, maxTs)
-				}}
-			/>
-			<Toggle
-				size="sm"
-				bind:checked={autoRefresh}
-				disabled={searchTerm != ''}
-				on:change={(e) => {
-					if (e.detail) {
-						getAllLogs(maxTs, undefined)
-					} else {
-						timeout && clearTimeout(timeout)
-					}
-				}}
-				options={{
-					right: 'Auto-refresh',
-					rightTooltip: 'Fetch new log files every 5 seconds. Paused while searching.'
-				}}
-			/>
-		</div>
+		{#if searchTerm !== '' && queryParseErrors && queryParseErrors.length > 0}
+			<div class="absolute right-2 top-1/2 -translate-y-1/2 z-10 flex">
+				<Popover notClickable placement="bottom-end">
+					<AlertTriangle size={16} class="text-yellow-500" />
+					{#snippet text()}
+						<div class="flex flex-col gap-1 text-xs">
+							<span>Some search terms were ignored because they could not be parsed:</span>
+							<ul class="list-disc pl-4">
+								{#each queryParseErrors ?? [] as msg}
+									<li>{msg}</li>
+								{/each}
+							</ul>
+						</div>
+					{/snippet}
+				</Popover>
+			</div>
+		{/if}
 	</div>
+	<!-- No width of its own: the preset labels run to "1000 last service logs", and a fixed box
+	     narrower than that does not clip it — the control's overflow is visible, so it spills into
+	     whatever sits next to it in the bar. -->
+	<TimeframeSelect
+		unifiedSize="sm"
+		items={serviceLogsTimeframes}
+		bind:value={timeframe}
+		{loading}
+		wrapperClasses="shrink-0"
+		onClick={() => {
+			minTs = undefined
+			maxTs = undefined
+			allLogs = undefined
+			const ts = timeframe.computeMinMax()
+			getAllLogs(ts.minTs ?? undefined, ts.maxTs ?? undefined)
+		}}
+	/>
+	<!-- The two labelled switches are the widest thing in this row, and the search field is the one
+	     that pays for them: it is the only control that yields width. So they fold into a popover
+	     well before the bar is tight, which keeps the field at its full width down to a much
+	     narrower window. Folded, not dropped — the page below no longer carries a toolbar they
+	     could fall back to, so hiding them would put them out of reach. -->
+	{#if compactSwitches}
+		<MeltPopover placement="bottom-end">
+			{#snippet trigger()}
+				<Button
+					variant="subtle"
+					unifiedSize="sm"
+					iconOnly
+					startIcon={{ icon: SlidersHorizontal }}
+					title="Log listing options"
+				/>
+			{/snippet}
+			{#snippet content()}
+				<div class="flex flex-col gap-3 p-3">
+					{@render logSwitches()}
+				</div>
+			{/snippet}
+		</MeltPopover>
+	{:else}
+		<div class="flex items-center gap-4 shrink-0">
+			{@render logSwitches()}
+		</div>
+	{/if}
+{/snippet}
 
+{#snippet logSwitches()}
+	<Toggle
+		size="sm"
+		bind:checked={withError}
+		options={{
+			right: 'With errors only',
+			rightTooltip: 'Only list the log files that contain at least one error line'
+		}}
+		on:change={() => {
+			allLogs = undefined
+			getAllLogs(minTs, maxTs)
+		}}
+	/>
+	<Toggle
+		size="sm"
+		bind:checked={autoRefresh}
+		disabled={searchTerm != ''}
+		on:change={(e) => {
+			if (e.detail) {
+				getAllLogs(maxTs, undefined)
+			} else {
+				timeout && clearTimeout(timeout)
+			}
+		}}
+		options={{
+			right: 'Auto-refresh',
+			rightTooltip: 'Fetch new log files every 5 seconds. Paused while searching.'
+		}}
+	/>
+{/snippet}
+
+<!-- The page's name is the breadcrumb's, so the band carries the hint beside it and the toolbar at
+     its far end; the page below starts straight into the logs.
+     No `separator`: the default draws the edge only while something is passing under the bar, and
+     the two panes below start lower than it with borders of their own, so at rest there is nothing
+     for the band to divide. -->
+<PageHeaderContent afterName={serviceLogsHint} actions={serviceLogsActions} actionsFlexible />
+
+<div class="flex flex-col grow min-h-0 min-w-0 gap-2 py-2">
 	{#if searchError}
 		<Alert type="warning" title="Service logs search unavailable" size="xs">
 			{searchError}
diff --git a/frontend/src/lib/components/SummaryPathDisplay.svelte b/frontend/src/lib/components/SummaryPathDisplay.svelte
index 22925e98e7..8fa0073b48 100644
--- a/frontend/src/lib/components/SummaryPathDisplay.svelte
+++ b/frontend/src/lib/components/SummaryPathDisplay.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import type { Snippet } from 'svelte'
 	import { emptyString, isOwner } from '$lib/utils'
 	import { Alert, Button } from '$lib/components/common'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
@@ -27,7 +28,26 @@
 		inheritedLabels?: string[] | undefined
 		editable?: boolean
 		onSaved?: (newPath: string) => void
-		kind?: 'flow' | 'script'
+		/** What is being renamed. An agent is a resource, so the path field is scoped to one and
+		 *  the write goes through the agent branch of the rename manager. */
+		kind?: 'flow' | 'script' | 'agent'
+		/** Saves instead of the API, for an item that exists only locally (a draft).
+		 * Returns an error message to keep the popover open. */
+		saveOverride?: (next: {
+			path: string
+			summary: string
+			labels: string[] | undefined
+		}) => string | undefined
+		/** Header variant: no path line (the host shows it) and a lighter summary. */
+		compact?: boolean
+		/** Rendered inside the trigger in place of the summary, for a host that hangs a second copy
+		 *  of this editor off something else it draws — the band's path segment. */
+		label?: Snippet
+		/** The trigger's own classes, for a host whose row has a look of its own. */
+		triggerClass?: string
+		/** Which field takes the cursor on open: the click says which half of the name the user came
+		 *  to change. `Path` is only reachable for an owner, so 'path' falls back to the summary. */
+		focusField?: 'summary' | 'path'
 	}
 
 	let {
@@ -37,41 +57,71 @@
 		inheritedLabels = undefined,
 		editable = false,
 		onSaved,
-		kind = 'flow'
+		kind = 'flow',
+		saveOverride = undefined,
+		compact = false,
+		label,
+		triggerClass = 'block min-w-0 max-w-full px-1 py-0.5 rounded text-left cursor-pointer hover:bg-surface-hover transition-colors',
+		focusField = 'summary'
 	}: Props = $props()
 
+	// An agent lives at a resource path, so that is what the picker validates against; the
+	// placeholder still says "agent", which is what the reader is naming.
+	const pathKind = $derived(kind === 'agent' ? 'resource' : kind)
+
 	let editSummary = $state('')
 	let editPath = $state('')
 	let dirtyPath = $state(false)
 	let popoverOpen = $state(false)
-	let ownPath = $state<string | undefined>(undefined)
-	// Derived: ownership answers about the operating workspace, whose user resolves asynchronously.
+	// Resolved before the popover opens, not on opening it: the path field only exists for an owner,
+	// and `openFocus` looks for it in the same flush the popover renders in.
 	const own = $derived(
-		ownPath === undefined ? false : isOwner(ownPath, actingUser, $operatingWorkspace)
+		saveOverride !== undefined || isOwner(path ?? '', actingUser, $operatingWorkspace)
 	)
 	let onBehalfOfEmail = $state<string | undefined>(undefined)
 	let summaryInput: ReturnType<typeof TextInput> | undefined = $state()
 	let labelsDirty = $state(false)
 	let hasChanges = $derived(editSummary !== (summary ?? '') || (own && dirtyPath) || labelsDirty)
 
-	$effect(() => {
-		if (popoverOpen && onSaved) {
-			editSummary = summary ?? ''
-			editPath = path ?? ''
-			labelsDirty = false
-			ownPath = path ?? ''
-			onBehalfOfEmail = undefined
-			if (kind === 'flow' && $operatingWorkspace && path) {
-				checkFlowOnBehalfOf($operatingWorkspace, path).then((email) => {
-					onBehalfOfEmail = email
-				})
-			}
-		}
-	})
+	/** Seeds the fields from the item and asks who a flow runs on behalf of. Called on the open
+	 *  transition rather than from an effect watching `popoverOpen`: that effect also read
+	 *  `summary`, `path` and the workspace, so a save or a rename landing while the popover was
+	 *  open reseeded the fields from the props — over whatever the user had typed. */
+	function onOpen() {
+		if (!onSaved) return
+		editSummary = summary ?? ''
+		editPath = path ?? ''
+		labelsDirty = false
+		onBehalfOfEmail = undefined
+		if (kind !== 'flow' || !$operatingWorkspace || !path) return
+		const askedFor = path
+		checkFlowOnBehalfOf($operatingWorkspace, path).then((email) => {
+			// The answer describes the path the popover opened on. Closed since, or moved to
+			// another path, it answers nothing on screen.
+			if (popoverOpen && path === askedFor) onBehalfOfEmail = email
+		})
+	}
+
+	/** The path's name field inside this popover. `Path` hardcodes `id="path"`, and melt resolves a
+	 *  string `openFocus` with a document-wide `querySelector`, so a popover portalled to the body
+	 *  would hand the keystrokes to whichever other `Path` the page happens to have mounted. */
+	const pathField = () =>
+		document.querySelector<HTMLInputElement>('[data-path-edit-path] #path') ?? null
 
 	async function save(close: () => void) {
 		const initialPath = path ?? ''
 		const newPath = own ? editPath : initialPath
+		if (saveOverride) {
+			const error = saveOverride({ path: newPath, summary: editSummary, labels })
+			if (error) {
+				sendUserToast(error, true)
+				return
+			}
+			labelsDirty = false
+			close()
+			onSaved?.(newPath)
+			return
+		}
 
 		try {
 			await updateItemPathAndSummary({
@@ -82,7 +132,7 @@
 				newSummary: editSummary,
 				labels
 			})
-			sendUserToast(`${kind === 'flow' ? 'Flow' : 'Script'} updated`)
+			sendUserToast(`${kind.charAt(0).toUpperCase()}${kind.slice(1)} updated`)
 			labelsDirty = false
 			close()
 			onSaved?.(newPath)
@@ -92,45 +142,48 @@
 	}
 </script>
 
-{#if editable || onSaved}
+{#snippet editor()}
+	<!-- Without naming the path's own field melt lands on the row's first button, so a popover
+	     opened from the path would not be typing into the path. -->
 	<Popover
-		class="min-w-0 max-w-full"
+		class={triggerClass}
 		placement="bottom-start"
 		contentClasses="p-4"
+		triggerAttrs={{ title: 'Edit summary and path', 'aria-label': 'Edit summary and path' }}
 		usePointerDownOutside
 		excludeSelectors=".drawer"
 		disableFocusTrap
-		openFocus={() => {
-			summaryInput?.focus()
-			return null
-		}}
-		bind:isOpen={popoverOpen}
+		openFocus={focusField === 'path' && own
+			? pathField
+			: () => {
+					summaryInput?.focus()
+					return null
+				}}
+		bind:isOpen={
+			() => popoverOpen,
+			(v) => {
+				const opening = v && !popoverOpen
+				popoverOpen = v
+				if (opening) onOpen()
+			}
+		}
 	>
 		{#snippet trigger()}
-			<div
-				class={'min-w-0 truncate flex flex-col items-start px-2 py-1 rounded-md transition-colors cursor-pointer hover:bg-surface-hover'}
-			>
-				<span class="text-2xs leading-tight text-tertiary font-mono font-normal truncate max-w-full"
-					>{path}</span
+			<!-- Both of the popover's arms show the summary and the path, and ownership decides
+					     whether the path can be changed, not whether it is there. -->
+			{#if label}
+				{@render label()}
+			{:else}
+				<span
+					class="{compact
+						? 'text-xs font-medium'
+						: 'text-sm font-semibold'} block truncate {emptyString(summary)
+						? 'text-tertiary italic font-normal'
+						: 'text-emphasis'}"
 				>
-				<div class="flex items-center gap-3 max-w-full">
-					<span
-						class="text-sm font-semibold truncate {emptyString(summary)
-							? 'text-tertiary italic font-normal'
-							: 'text-emphasis'}"
-					>
-						{emptyString(summary) ? 'Add a summary...' : summary}
-					</span>
-					{#if labels?.length}
-						<div class="flex items-center gap-0.5">
-							{#each labels as label}
-								<Badge color="blue" verySmall class="px-1" title="Label: {label}">{label}</Badge>
-							{/each}
-						</div>
-					{/if}
-					<InheritedLabels labels={inheritedLabels} />
-				</div>
-			</div>
+					{emptyString(summary) ? 'Add a summary...' : summary}
+				</span>
+			{/if}
 		{/snippet}
 		{#snippet content({ close })}
 			<div class="flex flex-col gap-6 w-[480px]">
@@ -168,16 +221,18 @@
 					{/if}
 					<Label label="Path">
 						{#if own}
-							<Path
-								autofocus={false}
-								bind:path={editPath}
-								bind:dirty={dirtyPath}
-								initialPath={path ?? ''}
-								namePlaceholder={kind}
-								{kind}
-								size="sm"
-								drawerOffset={4000}
-							/>
+							<div data-path-edit-path>
+								<Path
+									autofocus={false}
+									bind:path={editPath}
+									bind:dirty={dirtyPath}
+									initialPath={path ?? ''}
+									namePlaceholder={kind}
+									kind={pathKind}
+									size="sm"
+									drawerOffset={4000}
+								/>
+							</div>
 						{:else}
 							<span class="text-xs font-mono text-secondary">{path}</span>
 							<p class="text-2xs text-tertiary mt-1">Only the owner can change the path</p>
@@ -216,27 +271,69 @@
 					</label>
 					<div class="block text-primary">
 						<div class="pb-1 text-xs font-semibold text-emphasis">Path</div>
-						<Path
-							autofocus={false}
-							bind:path
-							bind:dirty={dirtyPath}
-							initialPath={path ?? ''}
-							namePlaceholder={kind}
-							{kind}
-							size="sm"
-							drawerOffset={4000}
-						/>
+						<div data-path-edit-path>
+							<Path
+								autofocus={false}
+								bind:path
+								bind:dirty={dirtyPath}
+								initialPath={path ?? ''}
+								namePlaceholder={kind}
+								kind={pathKind}
+								size="sm"
+								drawerOffset={4000}
+							/>
+						</div>
 					</div>
 				{/if}
 			</div>
 		{/snippet}
 	</Popover>
+{/snippet}
+
+{#if label && (editable || onSaved)}
+	<!-- The host draws the row this hangs in — the band's path segment — so only the trigger comes
+	     from here: no path line above it, and no second copy of the labels. -->
+	{@render editor()}
+{:else if editable || onSaved}
+	<!-- The name itself opens the popover, the same way the editors do it. Only the name: the whole
+	     block was the trigger once, which meant a path or a label you only wanted to read answered
+	     a click. -->
+	<div
+		class="min-w-0 truncate flex {compact
+			? 'items-center px-1 py-0.5'
+			: 'flex-col items-start px-2 py-1'}"
+	>
+		{#if !compact}
+			<span class="text-2xs leading-tight text-tertiary font-mono font-normal truncate max-w-full"
+				>{path}</span
+			>
+		{/if}
+		<div class="flex items-center gap-3 max-w-full min-w-0">
+			{@render editor()}
+			<!-- Outside the trigger: a label is read, not clicked through to a rename. -->
+			{#if labels?.length}
+				<div class="flex items-center gap-0.5">
+					{#each labels as labelText}
+						<Badge color="blue" verySmall class="px-1" title="Label: {labelText}">{labelText}</Badge
+						>
+					{/each}
+				</div>
+			{/if}
+			<InheritedLabels labels={inheritedLabels} />
+		</div>
+	</div>
+{:else if label}
+	<!-- Nothing to open, but the host still drew this into a slot of its own: give back what it
+	     handed over rather than this component's own block, which belongs in a row it owns. -->
+	{@render label()}
 {:else}
-	<div class="min-w-0 truncate flex flex-col px-2">
-		{#if !emptyString(summary)}
+	<div class="min-w-0 truncate flex items-center {compact ? '' : 'flex-col px-2'}">
+		{#if !emptyString(summary) && !compact}
 			<span class="text-[10px] leading-tight text-tertiary font-mono truncate">{path}</span>
 		{/if}
-		<span class="text-sm font-semibold text-emphasis truncate">
+		<span
+			class="{compact ? 'text-xs font-medium' : 'text-sm font-semibold'} text-emphasis truncate"
+		>
 			{emptyString(summary) ? (path ?? '') : summary}
 		</span>
 	</div>
diff --git a/frontend/src/lib/components/SuperadminSettingsInner.svelte b/frontend/src/lib/components/SuperadminSettingsInner.svelte
index 0fd7991597..62bd015b92 100644
--- a/frontend/src/lib/components/SuperadminSettingsInner.svelte
+++ b/frontend/src/lib/components/SuperadminSettingsInner.svelte
@@ -372,7 +372,7 @@
 								</div>
 							{/if}
 
-							<Tabs bind:selected={usersSubTab} class="mb-4">
+							<Tabs bind:selected={usersSubTab} class="mb-4" wrapperClass="shrink-0">
 								<Tab value="users" label="Users" />
 								{#if extJwtTokens.length > 0}
 									<Tab value="ext_jwt" label="External JWTs" />
diff --git a/frontend/src/lib/components/WorkerGroup.svelte b/frontend/src/lib/components/WorkerGroup.svelte
index 3b399a5a1e..5e8957c31a 100644
--- a/frontend/src/lib/components/WorkerGroup.svelte
+++ b/frontend/src/lib/components/WorkerGroup.svelte
@@ -55,6 +55,7 @@
 	import TagList from './TagList.svelte'
 	import DedicatedWorkersSelector from './DedicatedWorkersSelector.svelte'
 	import { computeHashedTag } from './dedicated_worker'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import ObjectStoreConfigSettings, {
 		type ObjectStoreConfig
 	} from './ObjectStoreConfigSettings.svelte'
@@ -1238,7 +1239,7 @@
 				<p class="text-xs text-tertiary">Requires a superadmin token.</p>
 				<pre
 					class="mt-1 p-2 bg-surface-secondary rounded text-xs overflow-x-auto whitespace-pre-wrap break-all"
-					>curl -X POST '{window.location.origin}/api/configs/update/worker__{name}' \
+					>curl -X POST '{apiBaseUrl()}/api/configs/update/worker__{name}' \
   -H 'Content-Type: application/json' \
   -H 'Authorization: Bearer &lt;token&gt;' \
   -d '{JSON.stringify(cleanWorkerGroupConfig(nconfig ?? {}), null, 2)}'</pre
diff --git a/frontend/src/lib/components/WorkspaceDeployLayout.svelte b/frontend/src/lib/components/WorkspaceDeployLayout.svelte
index 66beb18b73..de666451ee 100644
--- a/frontend/src/lib/components/WorkspaceDeployLayout.svelte
+++ b/frontend/src/lib/components/WorkspaceDeployLayout.svelte
@@ -38,6 +38,9 @@
 		deploymentStatus: Record<string, { status: 'loading' | 'deployed' | 'failed'; error?: string }>
 		allSelected?: boolean
 		emptyMessage?: string
+		/** The list is empty because it has not arrived yet. An empty list and an unanswered one
+		 *  look alike from here, and "no changes" is a claim that needs an answer behind it. */
+		loading?: boolean
 		hideSelection?: boolean
 		children?: Snippet
 
@@ -70,6 +73,7 @@
 		deploymentStatus,
 		allSelected = false,
 		emptyMessage = 'No items to deploy',
+		loading = false,
 		hideSelection = false,
 		header,
 		alerts,
@@ -308,6 +312,11 @@
 				{/each}
 			</div>
 		</div>
+	{:else if loading}
+		<div class="flex items-center justify-center h-full gap-2 text-hint text-xs">
+			<Loader2 class="animate-spin w-4 h-4" />
+			Comparing…
+		</div>
 	{:else}
 		<div class="flex items-center justify-center h-full">
 			<div class="text-hint text-xs">{emptyMessage}</div>
diff --git a/frontend/src/lib/components/WorkspaceDraftsBanner.svelte b/frontend/src/lib/components/WorkspaceDraftsBanner.svelte
index 2e0110f710..c77082fbf3 100644
--- a/frontend/src/lib/components/WorkspaceDraftsBanner.svelte
+++ b/frontend/src/lib/components/WorkspaceDraftsBanner.svelte
@@ -1,10 +1,11 @@
 <script lang="ts">
 	import { workspaceStore, userWorkspaces } from '$lib/stores'
 	import { workspaceIsFork } from '$lib/utils/workspaceHierarchy'
-	import { Button } from './common'
-	import { Pencil } from 'lucide-svelte'
+	import { Badge, Button } from './common'
 	import { goto } from '$app/navigation'
 	import { useWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
 
 	// Surfaces pending drafts (scripts/flows/apps) for the current workspace and
 	// links to the compare page in draft mode. Mutually exclusive with
@@ -26,26 +27,33 @@
 			})
 		}
 	}
+	const phone = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR)
 </script>
 
 {#if !isFork && draftCount > 0}
-	<!-- Side padding mirrors the page content container below, so the banner
-	     stays aligned with it instead of bleeding to the viewport edges. -->
-	<div class="w-full text-xs max-w-7xl mx-auto px-4 sm:px-8 pt-2">
-		<div class="bg-blue-50 dark:bg-blue-900 rounded-md px-4 py-2">
-			<div class="flex flex-wrap items-center justify-between gap-x-3 gap-y-2">
-				<div class="flex items-center gap-3 min-w-0">
-					<Pencil class="w-4 h-4 text-accent shrink-0" />
-					<span class="text-xs font-medium text-blue-900 dark:text-blue-100">
-						This workspace has {draftCount} draft{draftCount !== 1 ? 's' : ''}
-					</span>
-				</div>
-				<!-- Same button as the sibling ForkWorkspaceBanner CTA (they sit on the
-				     same home page), kept visually identical on purpose. -->
-				<Button variant="default" unifiedSize="sm" onclick={openDraftCompare}>
-					Review & deploy drafts
-				</Button>
-			</div>
-		</div>
-	</div>
+	<!-- In the band rather than a banner over the page: it is a standing fact about the workspace,
+	     not an interruption, and one button says it and acts on it. -->
+	<PageHeaderContent actions={draftsAction} actionsOrder={-100} />
 {/if}
+
+{#snippet draftsAction()}
+	<!-- On a phone the badge becomes the button: the count is the part that has to be seen, and
+	     the bar has room for one thing. -->
+	{#if phone}
+		<Button
+			variant="subtle"
+			unifiedSize="sm"
+			onclick={openDraftCompare}
+			title="Review & deploy drafts"
+		>
+			<Badge color="blue" small>{draftCount}</Badge>
+		</Button>
+	{:else}
+		<Badge color="blue" small>
+			{draftCount} draft{draftCount !== 1 ? 's' : ''}
+		</Badge>
+		<Button variant="subtle" unifiedSize="sm" onclick={openDraftCompare}>
+			Review & deploy drafts
+		</Button>
+	{/if}
+{/snippet}
diff --git a/frontend/src/lib/components/WorkspaceItemKindIcon.svelte b/frontend/src/lib/components/WorkspaceItemKindIcon.svelte
new file mode 100644
index 0000000000..9d07f6ef89
--- /dev/null
+++ b/frontend/src/lib/components/WorkspaceItemKindIcon.svelte
@@ -0,0 +1,19 @@
+<!--
+@component
+The glyph the rest of the app gives a workspace item's kind (see RowIcon), at the caller's size.
+-->
+<script lang="ts">
+	import { Code2, LayoutDashboard } from 'lucide-svelte'
+	import BarsStaggered from '$lib/components/icons/BarsStaggered.svelte'
+	import type { WorkspaceItemKind } from '$lib/components/workspacePicker'
+
+	let { kind, size = 14 }: { kind: WorkspaceItemKind; size?: number } = $props()
+</script>
+
+{#if kind === 'flow'}
+	<BarsStaggered {size} class="flex-shrink-0 text-teal-500" />
+{:else if kind === 'app'}
+	<LayoutDashboard {size} class="flex-shrink-0 text-orange-500" />
+{:else}
+	<Code2 {size} class="flex-shrink-0 text-blue-500" />
+{/if}
diff --git a/frontend/src/lib/components/WorkspaceScopeTrigger.svelte b/frontend/src/lib/components/WorkspaceScopeTrigger.svelte
index 77fe52b421..37a27f3812 100644
--- a/frontend/src/lib/components/WorkspaceScopeTrigger.svelte
+++ b/frontend/src/lib/components/WorkspaceScopeTrigger.svelte
@@ -2,8 +2,8 @@
 	import { userWorkspaces, type UserWorkspace } from '$lib/stores'
 	import { findWorkspaceRoot } from '$lib/utils/workspaceHierarchy'
 	import { forkAccentStyle } from '$lib/utils/forkColor'
-	import { Badge, Button } from '$lib/components/common'
-	import { devBadgeText } from '$lib/utils/devWorkspaceLabel'
+	import { Button } from '$lib/components/common'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 	import { Building, ChevronDown, EllipsisVertical, GitFork } from 'lucide-svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import { type Item } from '$lib/utils'
@@ -171,12 +171,12 @@
 			{#if pendingFork}
 				<span class="shrink-0 opacity-70 font-normal">(new)</span>
 			{:else if currentWs?.is_dev_workspace}
-				<Badge
-					color="dark-blue"
-					small
-					class="text-3xs px-1 py-0 dark:bg-surface-accent-primary text-white dark:text-white"
-					>{devBadgeText(currentWs.dev_workspace_label)}</Badge
-				>
+				<DevWorkspaceBadge
+					label={currentWs.dev_workspace_label}
+					color={color ?? (pendingFork ? undefined : currentWs.color)}
+					fallbackClass="dark:bg-surface-accent-primary text-white dark:text-white"
+					class="text-3xs px-1 py-0"
+				/>
 			{/if}
 		{/if}
 	</Button>
diff --git a/frontend/src/lib/components/apps/editor/AppEditor.svelte b/frontend/src/lib/components/apps/editor/AppEditor.svelte
index 073d6c3e7d..ac0d2b1cb6 100644
--- a/frontend/src/lib/components/apps/editor/AppEditor.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditor.svelte
@@ -86,7 +86,8 @@
 		othersDraftsCount = 0,
 		onOpenOthersDrafts,
 		onRestore,
-		onDeploy
+		onDeploy,
+		ownsPageHeader = false
 	}: AppEditorProps = $props()
 
 	migrateApp(untrack(() => app))
@@ -885,6 +886,7 @@
 {#if !$userStore?.operator}
 	{#if $appStore}
 		<AppEditorHeader
+			{ownsPageHeader}
 			{newPath}
 			{newApp}
 			{labels}
@@ -914,7 +916,7 @@
 			onHideBottomPanel={() => hideBottomPanel()}
 		/>
 		{#if $mode === 'preview'}
-			<SplitPanesWrapper class="border-t">
+			<SplitPanesWrapper>
 				<div
 					class={twMerge(
 						'h-full w-full relative',
@@ -959,7 +961,7 @@
 				</div>
 			{/if}
 
-			<SplitPanesWrapper class="border-t">
+			<SplitPanesWrapper>
 				<Splitpanes id="o1" class="max-w-full overflow-hidden">
 					<Pane bind:size={leftPanelSize} minSize={5} maxSize={33}>
 						<div
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
index 5ea5a804f1..f07d596baa 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
@@ -8,7 +8,7 @@
 	import { discardDraftAfterDeploy } from '$lib/userDraftToast'
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 	import { enterpriseLicense, userStore, userWorkspaces, workspaceStore } from '$lib/stores'
-	import { isMac, type Item, userPathPrefix } from '$lib/utils'
+	import { isMac, type Item, userPathPrefix, emptyString } from '$lib/utils'
 	import { random_adj } from '$lib/components/random_positive_adjetive'
 	import {
 		AlignHorizontalSpaceAround,
@@ -32,7 +32,7 @@
 		Zap,
 		Globe
 	} from 'lucide-svelte'
-	import { getContext, onDestroy, untrack } from 'svelte'
+	import { getContext, onDestroy, untrack, type Snippet } from 'svelte'
 	import { orderedJsonStringify, type Value, replaceFalseWithUndefined } from '../../../utils'
 	import type { App, AppEditorContext, AppViewerContext } from '../types'
 	import { toStatic } from '../utils'
@@ -52,6 +52,9 @@
 	import DebugPanel from './contextPanel/DebugPanel.svelte'
 
 	import EditorHeader from '$lib/components/EditorHeader.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
 	import AutosaveIndicator from '$lib/components/AutosaveIndicator.svelte'
 	import { editPathFor } from '$lib/components/workspacePicker'
 	import { invalidateWorkspacePaths } from '$lib/components/PathNameAutocomplete.svelte'
@@ -114,6 +117,8 @@
 		// the deploy wrote, for the next draft's fork base, and `head` what is deployed
 		// now, with its author and time.
 		onDeploy?: (e: { version?: number; head?: number; headBy?: string; headAt?: string }) => void
+		/** True for the route's own editor: its top bar becomes the page header. */
+		ownsPageHeader?: boolean
 	}
 
 	let {
@@ -142,10 +147,11 @@
 		othersDraftsCount = 0,
 		onOpenOthersDrafts,
 		onRestore,
-		onDeploy
+		onDeploy,
+		ownsPageHeader = false
 	}: Props = $props()
 
-	/** Mirror of the path the user is editing in the pen popover. Initialized
+	/** Mirror of the path the user is editing in the rename popover. Initialized
 	 * once from `newPath` (or a synthesized path for new apps) and only
 	 * updated by user input from then on — we deliberately do NOT sync from
 	 * `newPath` afterwards so the user's in-flight rename isn't clobbered by
@@ -223,6 +229,18 @@
 	// the preview to the deployed version.
 	const inSessionPane = !!getContext('aiChatManager')
 
+	// The header's buttons render under the page header, not under this component, so the contexts
+	// they look up have to travel with them. The app's own two carry everything the canvas toggles,
+	// the panel buttons, Debug runs and the preview switch read.
+	/** Held by the rename popover while it is open; the band's trail reads it so the path does not
+	 *  reflow under the pointer as the user types. */
+	let pathSnapshot = $state<string | undefined>(undefined)
+
+	const headerContexts = new Map<any, any>([
+		['AppViewerContext', getContext('AppViewerContext')],
+		['AppEditorContext', getContext('AppEditorContext')]
+	])
+
 	const loading = $state({
 		publish: false,
 		save: false
@@ -243,7 +261,24 @@
 
 	// Top-bar responsive collapse — container width, not viewport.
 	let topbarWidth = $state(0)
-	const compactTopbar = $derived(topbarWidth > 0 && topbarWidth < 720)
+	// In the page header the buttons share the row with the breadcrumb, so they shed the canvas
+	// toggles and fold Debug runs into the menu sooner: the whole group is ~840px and the trail
+	// with the summary takes ~430px of the same row.
+	// Measured on the band rather than estimated: with the canvas toggles shown the actions alone
+	// are 826-911px and the trail with the summary another ~500, so the row overflows the bar at
+	// every width up to about 1470 — 1350 was not high enough either. Below this the toggles stand
+	// down and the menu carries all three, which is what keeps them reachable rather than merely
+	// out of the way.
+	const compactBelow = $derived(ownsPageHeader ? 1500 : 720)
+	const compactTopbar = $derived.by(() => {
+		const w = ownsPageHeader ? pageHeader.barWidth : topbarWidth
+		return w > 0 && w < compactBelow
+	})
+	// A phone's bar holds the trail and Deploy. Which panels are open, the export and the
+	// editor/preview switch join the menu compact already shows.
+	const phoneTopbar = $derived(
+		ownsPageHeader && pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR
+	)
 
 	function closeSaveDrawer() {
 		saveDrawerOpen = false
@@ -590,7 +625,49 @@
 								selectedJobId = $jobs[$jobs.length - 1]
 							}
 							$jobsDrawerOpen = true
-						},
+						}
+					},
+					// The canvas toggles stand down with the bar, and the breakpoint among them is the
+					// only way onto the mobile layout — so each one keeps an entry here.
+					{
+						displayName: $breakpoint === 'sm' ? 'Computer view' : 'Mobile view',
+						icon: $breakpoint === 'sm' ? Laptop2 : Smartphone,
+						action: () => ($breakpoint = $breakpoint === 'sm' ? 'lg' : 'sm')
+					},
+					// The setting the mobile view is edited for, which otherwise lives beside the
+					// toggle group that stood down: without it here a deployed app could be put on
+					// the mobile layout at this width and never taken off it.
+					...($breakpoint === 'sm'
+						? [
+								{
+									displayName: $app?.mobileViewOnSmallerScreens
+										? 'Mobile view on small screens: on'
+										: 'Mobile view on small screens: off',
+									icon: Smartphone,
+									action: () => {
+										if ($app) $app.mobileViewOnSmallerScreens = !$app.mobileViewOnSmallerScreens
+									}
+								}
+							]
+						: []),
+					{
+						displayName: $app?.fullscreen ? 'Centered canvas' : 'Full-width canvas',
+						icon: $app?.fullscreen ? AlignHorizontalSpaceAround : Expand,
+						action: () => {
+							if ($app) $app.fullscreen = !$app.fullscreen
+						}
+					},
+					{
+						displayName:
+							$app?.darkMode === undefined
+								? 'Theme: automatic'
+								: $app.darkMode
+									? 'Theme: dark'
+									: 'Theme: light',
+						icon: $app?.darkMode === undefined ? SunMoon : $app.darkMode ? Moon : Sun,
+						// Cycles auto → light → dark, the order the toggle group reads in.
+						action: () =>
+							setTheme($app?.darkMode === undefined ? false : $app.darkMode ? undefined : true),
 						separatorBottom: true
 					}
 				]
@@ -913,141 +990,232 @@
 
 <AppReportsDrawer bind:open={appReportingDrawerOpen} appPath={$appPath ?? ''} />
 
-<div
-	bind:clientWidth={topbarWidth}
-	class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto max-h-12 h-12 shrink-0"
->
-	<!-- Identity block shrinks/truncates first (min-w-0) so the cloud indicator
+{#if ownsPageHeader}
+	<!-- The editor's own top bar is the page header on this route: the app's path and summary are
+	     the breadcrumb's, and everything else the bar carried rides along as the header's actions. -->
+	<PageHeaderContent
+		item={{
+			// The path being edited, not the stored one: a brand-new app is parked at a
+			// `draft_<uuid>` placeholder, and the trail would name that instead of the path Deploy
+			// will create. Same fallback chain the rename sites read.
+			// Frozen while the rename popover is open so the trail holds still as the user types.
+			kind: 'app',
+			path: pathSnapshot ?? (newEditedPath || $appPath || newPath || undefined),
+			summaryContent: appSummary,
+			pathTrigger: appPathTrigger
+		}}
+		actions={appHeaderActions}
+		contexts={headerContexts}
+		separator="always"
+	/>
+{:else}
+	<div
+		bind:clientWidth={topbarWidth}
+		class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto max-h-12 h-12 shrink-0"
+	>
+		<!-- Identity block shrinks/truncates first (min-w-0) so the cloud indicator
 	     and the pinned action groups (shrink-0 below) stay visible on narrow
 	     widths instead of the breadcrumb overflowing and hiding them. Kept at
 	     min-w-0 (not flex-1) so justify-between still positions the panel-hide
 	     buttons between the identity and the actions. -->
-	<div class="flex flex-row gap-2 items-center min-w-0">
-		<div class="min-w-0 overflow-hidden">
-			<EditorHeader
-				bind:summary={$summary}
-				bind:path={newEditedPath}
-				savedPath={$appPath || newPath || undefined}
-				kind="app"
-				onNavigate={(item) => (onNavigate ? onNavigate(item) : goto(editPathFor(item)))}
-			/>
-		</div>
-		<div class="flex gap-2 shrink-0 {compactTopbar ? 'hidden' : ''}">
-			{#if $app}
-				<ToggleButtonGroup
-					selected={$app.fullscreen ? 'true' : 'false'}
-					on:selected={({ detail }) => {
-						$app.fullscreen = detail === 'true'
-					}}
-				>
-					{#snippet children({ item })}
-						<ToggleButton
-							icon={AlignHorizontalSpaceAround}
-							iconOnly
-							value={'false'}
-							tooltip="The max width is 1168px and the content stay centered instead of taking the full page width"
-							{item}
-							size="md"
-						/>
-						<ToggleButton
-							tooltip="The width is of the app if the full width of its container"
-							icon={Expand}
-							iconOnly
-							value={'true'}
-							{item}
-							size="md"
-						/>
-					{/snippet}
-				</ToggleButtonGroup>
-			{/if}
-			{#if $app}
-				<ToggleButtonGroup
-					on:selected={({ detail }) => {
-						const theme = detail === 'dark' ? true : detail === 'sun' ? false : undefined
-						setTheme(theme)
-					}}
-					selected={$app.darkMode === undefined ? 'auto' : $app.darkMode ? 'dark' : 'sun'}
-				>
-					{#snippet children({ item })}
-						<ToggleButton
-							icon={SunMoon}
-							iconOnly
-							value={'auto'}
-							tooltip="The app mode between dark/light is automatic"
-							{item}
-							size="md"
-						/>
-						<ToggleButton
-							icon={Sun}
-							iconOnly
-							value={'sun'}
-							tooltip="Force light mode"
-							{item}
-							size="md"
-						/>
-						<ToggleButton
-							tooltip="Force dark mode"
-							icon={Moon}
-							iconOnly
-							value={'dark'}
-							{item}
-							size="md"
-						/>
-					{/snippet}
-				</ToggleButtonGroup>
-			{/if}
-			<div class="flex flex-row gap-2">
-				<ToggleButtonGroup bind:selected={$breakpoint}>
-					{#snippet children({ item })}
-						<ToggleButton
-							tooltip="Computer View"
-							icon={Laptop2}
-							iconOnly
-							value={'lg'}
-							{item}
-							size="md"
-						/>
-						<ToggleButton
-							tooltip="Mobile View"
-							icon={Smartphone}
-							iconOnly
-							value={'sm'}
-							{item}
-							size="md"
-						/>
-						{#if $breakpoint === 'sm'}
-							<Toggle
-								size="xs"
-								options={{
-									right: 'Enable mobile view for smaller screens',
-									rightTooltip:
-										'Desktop view is enabled by default. Enable this to customize the layout of the components for the mobile view'
-								}}
-								textClass="text-2xs whitespace-nowrap white !w-full"
-								bind:checked={$app.mobileViewOnSmallerScreens}
-								class="flex flex-row px-2 items-center"
-							/>
-						{/if}
-					{/snippet}
-				</ToggleButtonGroup>
-			</div>
-		</div>
-		{#if $workspaceStore}
-			<div class="ml-4">
-				<AutosaveIndicator
-					workspace={$workspaceStore}
-					itemKind="app"
-					path={userDraftPath}
-					draftOnly={newApp}
-					{onResetToDeployed}
-					{loadedFromDraft}
-					{othersDraftsCount}
-					{onOpenOthersDrafts}
+		<div class="flex flex-row gap-2 items-center min-w-0">
+			<div class="min-w-0 overflow-hidden">
+				<EditorHeader
+					bind:summary={$summary}
+					bind:path={newEditedPath}
+					savedPath={$appPath || newPath || undefined}
+					kind="app"
+					onNavigate={(item) => (onNavigate ? onNavigate(item) : goto(editPathFor(item)))}
 				/>
 			</div>
-		{/if}
-	</div>
+			{@render canvasToggles()}
+			{@render autosaveIndicator()}
+		</div>
 
+		{@render panelButtons()}
+		{@render awarenessMark()}
+		{@render appActions()}
+	</div>
+{/if}
+
+<!-- The summary's editor again, hung off the band's path segment so it opens under the path, with
+     the cursor in the path field. `bind:` cannot be spread, so the slots are written out twice;
+     both instances bind the same ones and only one is ever open. -->
+{#snippet appPathTrigger(pathLabel: Snippet, triggerClass: string)}
+	<PathEditPopover
+		label={pathLabel}
+		{triggerClass}
+		focusField="path"
+		bind:summary={$summary}
+		bind:path={newEditedPath}
+		bind:snapshotPath={pathSnapshot}
+		savedPath={$appPath || newPath || undefined}
+		kind="app"
+	/>
+{/snippet}
+
+{#snippet appSummary()}
+	<!-- Not edited in place: clicking the name opens the summary and the path together, so the band
+	     reads as a name rather than a form. `title` for one it truncates. -->
+	<div class="flex items-center gap-1 min-w-0">
+		{#snippet summaryText()}
+			<span
+				class="min-w-0 truncate text-xs {emptyString($summary)
+					? 'text-tertiary italic font-normal'
+					: 'font-medium text-emphasis'}"
+				title={$summary}>{emptyString($summary) ? 'Add a summary...' : $summary}</span
+			>
+		{/snippet}
+		<PathEditPopover
+			label={summaryText}
+			bind:summary={$summary}
+			bind:path={newEditedPath}
+			bind:snapshotPath={pathSnapshot}
+			savedPath={$appPath || newPath || undefined}
+			kind="app"
+		/>
+	</div>
+{/snippet}
+
+{#snippet appHeaderActions()}
+	<!-- The bar's own order kept: what the canvas looks like, how the draft is doing, which panels
+	     are open, then what to do with the app. The set scrolls rather than pushing past the end of
+	     the bar — this editor carries the widest action row of any page, and the row it replaced
+	     scrolled for the same reason. -->
+	<div
+		class="flex flex-row items-center gap-2 min-w-0 overflow-x-auto scrollbar-hidden whitespace-nowrap"
+	>
+		{@render canvasToggles()}
+		{@render autosaveIndicator()}
+		{#if !phoneTopbar}
+			{@render panelButtons()}
+			{@render awarenessMark()}
+		{/if}
+		{@render appActions()}
+	</div>
+{/snippet}
+
+{#snippet canvasToggles()}
+	<div class="flex gap-2 shrink-0 {compactTopbar ? 'hidden' : ''}">
+		{#if $app}
+			<ToggleButtonGroup
+				selected={$app.fullscreen ? 'true' : 'false'}
+				on:selected={({ detail }) => {
+					$app.fullscreen = detail === 'true'
+				}}
+			>
+				{#snippet children({ item })}
+					<ToggleButton
+						icon={AlignHorizontalSpaceAround}
+						iconOnly
+						value={'false'}
+						tooltip="The max width is 1168px and the content stay centered instead of taking the full page width"
+						{item}
+						size="md"
+					/>
+					<ToggleButton
+						tooltip="The width is of the app if the full width of its container"
+						icon={Expand}
+						iconOnly
+						value={'true'}
+						{item}
+						size="md"
+					/>
+				{/snippet}
+			</ToggleButtonGroup>
+		{/if}
+		{#if $app}
+			<ToggleButtonGroup
+				on:selected={({ detail }) => {
+					const theme = detail === 'dark' ? true : detail === 'sun' ? false : undefined
+					setTheme(theme)
+				}}
+				selected={$app.darkMode === undefined ? 'auto' : $app.darkMode ? 'dark' : 'sun'}
+			>
+				{#snippet children({ item })}
+					<ToggleButton
+						icon={SunMoon}
+						iconOnly
+						value={'auto'}
+						tooltip="The app mode between dark/light is automatic"
+						{item}
+						size="md"
+					/>
+					<ToggleButton
+						icon={Sun}
+						iconOnly
+						value={'sun'}
+						tooltip="Force light mode"
+						{item}
+						size="md"
+					/>
+					<ToggleButton
+						tooltip="Force dark mode"
+						icon={Moon}
+						iconOnly
+						value={'dark'}
+						{item}
+						size="md"
+					/>
+				{/snippet}
+			</ToggleButtonGroup>
+		{/if}
+		<div class="flex flex-row gap-2">
+			<ToggleButtonGroup bind:selected={$breakpoint}>
+				{#snippet children({ item })}
+					<ToggleButton
+						tooltip="Computer View"
+						icon={Laptop2}
+						iconOnly
+						value={'lg'}
+						{item}
+						size="md"
+					/>
+					<ToggleButton
+						tooltip="Mobile View"
+						icon={Smartphone}
+						iconOnly
+						value={'sm'}
+						{item}
+						size="md"
+					/>
+					{#if $breakpoint === 'sm'}
+						<Toggle
+							size="xs"
+							options={{
+								right: 'Enable mobile view for smaller screens',
+								rightTooltip:
+									'Desktop view is enabled by default. Enable this to customize the layout of the components for the mobile view'
+							}}
+							textClass="text-2xs whitespace-nowrap white !w-full"
+							bind:checked={$app.mobileViewOnSmallerScreens}
+							class="flex flex-row px-2 items-center"
+						/>
+					{/if}
+				{/snippet}
+			</ToggleButtonGroup>
+		</div>
+	</div>
+{/snippet}
+
+{#snippet autosaveIndicator()}
+	{#if $workspaceStore}
+		<div class="ml-4">
+			<AutosaveIndicator
+				workspace={$workspaceStore}
+				itemKind="app"
+				path={userDraftPath}
+				draftOnly={newApp}
+				{onResetToDeployed}
+				{loadedFromDraft}
+				{othersDraftsCount}
+				{onOpenOthersDrafts}
+			/>
+		</div>
+	{/if}
+{/snippet}
+
+{#snippet panelButtons()}
 	{#if $mode !== 'preview'}
 		<div class="flex gap-1 shrink-0">
 			<HideButton
@@ -1085,11 +1253,17 @@
 			/>
 		</div>
 	{/if}
+{/snippet}
+
+{#snippet awarenessMark()}
 	{#if $enterpriseLicense && $appPath != '' && !inSessionPane}
 		<div class="shrink-0">
 			<Awareness />
 		</div>
 	{/if}
+{/snippet}
+
+{#snippet appActions()}
 	<div class="flex flex-row gap-2 justify-end items-center overflow-visible shrink-0">
 		<Dropdown items={moreItems} />
 
@@ -1131,14 +1305,19 @@
 				</div>
 			</Button>
 		</div>
+		<!-- Draws nothing in the bar: it is the export drawer, opened from the menu's Export
+		     entries through this instance. The preview switch keeps its place on a phone, since
+		     seeing the app is most of what an app editor is good for on one. -->
 		<AppExportButton bind:this={appExport} />
-		<PreviewToggle loading={loading.save} />
+		<PreviewToggle loading={loading.save} iconOnly={phoneTopbar} />
 		<Button
 			variant="accent"
 			loading={loading.save}
 			startIcon={{ icon: Save }}
 			on:click={save}
-			unifiedSize="md"
+			iconOnly={phoneTopbar}
+			title="Deploy"
+			unifiedSize={phoneTopbar ? 'sm' : 'md'}
 			dropdownItems={$appPath != ''
 				? () => [
 						{
@@ -1163,4 +1342,4 @@
 			Deploy
 		</Button>
 	</div>
-</div>
+{/snippet}
diff --git a/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte b/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
index e004c17a04..cb56b37498 100644
--- a/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
+++ b/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
@@ -13,13 +13,18 @@
 	import { sendUserToast } from '$lib/toast'
 	import PublicApp from '$lib/components/apps/editor/PublicApp.svelte'
 	import PublicAppFrame from '$lib/components/apps/editor/PublicAppFrame.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
+	import type { Item } from '$lib/utils'
 	import { Button } from '$lib/components/common'
 	import { AppService, OpenAPI } from '$lib/gen'
-	import type { UserExt } from '$lib/stores'
+	import { userStore, type UserExt } from '$lib/stores'
 	import { canWrite } from '$lib/utils'
 	import { getUserExt } from '$lib/user'
-	import { Pen } from 'lucide-svelte'
+	import { ExternalLink, Pen } from 'lucide-svelte'
 	import { page } from '$app/state'
+	import { isMenuHidden } from '$lib/components/sessions/sessionMode.svelte'
 	import {
 		setOperatingWorkspace,
 		useOperatingUser
@@ -30,10 +35,15 @@
 		path,
 		onEdit,
 		onLoadState,
-		syncHashToUrl = true
+		syncHashToUrl = true,
+		ownsPageHeader = false
 	}: {
 		workspace: string
 		path: string
+		/** True for the route's own page: the app becomes what the page header names. A host that
+		 * renders this inside something else — a session's preview panel, whose band names the
+		 * session — leaves it false, and the app keeps its Edit over its own canvas. */
+		ownsPageHeader?: boolean
 		/** Handle Edit in place instead of following `editHref`. An AI session shows
 		 * this viewer inside a preview tab, where a plain link would navigate the whole
 		 * page out of the session rather than flipping the tab to its editor. */
@@ -70,6 +80,12 @@
 	 * app point at /apps/get all over the app), so only the app can say which
 	 * editor the Edit button must open. */
 	let isRawApp = $state(false)
+	/** The app's execution mode, from the same lite read as the permissions and for the same
+	 * reason: a sandboxed low-code app loads inside the opaque iframe, so `app` here stays
+	 * undefined and cannot say whether the app answers at a public url. `policy.execution_mode` is
+	 * where the lite payload carries it; the flat field beside it is the apps *list* row's
+	 * spelling (ListableApp, which is what AppRow reads). */
+	let executionMode = $state<string | undefined>(undefined)
 	let editHref = $derived(`${base}/${isRawApp ? 'apps_raw' : 'apps'}/edit/${path}?nodraft=true`)
 	let refresh: (() => void) | undefined
 
@@ -85,6 +101,11 @@
 	const hideEditBtn = page.url.searchParams.get('hideEditBtn') === 'true'
 	const hideRefreshBar = page.url.searchParams.get('hideRefreshBar') === 'true'
 
+	const showEdit = $derived(canWriteApp && !hideEditBtn)
+	// Decides where Edit goes, not whether it appears: without the workspace navigation there is
+	// no band to put it in. Same rule the layout hides the sidebar by.
+	const menuHidden = $derived(isMenuHidden(page.url))
+
 	// Embedder side: mint a scoped embed token (by path) from the member's session.
 	async function fetchEmbedToken(opts?: { sdkConsent?: boolean }): Promise<{ token?: string }> {
 		const headers: Record<string, string> = {}
@@ -155,48 +176,142 @@
 			const lite: any = await AppService.getAppLiteByPath({ workspace, path })
 			appPerms = { path: lite?.path ?? path, extraPerms: lite?.extra_perms ?? {} }
 			isRawApp = !!lite?.raw_app
+			executionMode = lite?.policy?.execution_mode ?? lite?.execution_mode
 		} catch (_) {
 			appPerms = undefined
 		}
 	}
 
+	/** Whether the app answers at a public url at all. Read from the app this viewer has already
+	 *  loaded, the way the apps table decides the same thing (AppRow) — the secret itself is a
+	 *  request, and asking for one on every app view to decide whether to draw a button is a
+	 *  request per view that most views never use. */
+	const hasPublicUrl = $derived(executionMode === 'anonymous')
+	/** Resolved when the button is used, not when it is drawn. */
+	async function openPublicUrl() {
+		// The tab is opened inside the click itself and filled once the secret arrives. Safari only
+		// lets a gesture open the tab it opens synchronously, so opening it after the await is
+		// blocked there — silently, since a blocked popup reports nothing.
+		const tab = window.open('about:blank', '_blank')
+		try {
+			const secret = await AppService.getPublicSecretOfApp({ workspace, path })
+			if (!secret) {
+				tab?.close()
+				sendUserToast('This app has no public url', true)
+				return
+			}
+			// Built from this viewer's workspace rather than the navigation one, like everything
+			// else here: the two differ inside a session's preview panel.
+			const url = `${window.location.origin}${base}/public/${workspace}/${secret}`
+			if (tab) tab.location.href = url
+			else sendUserToast('Allow pop-ups for this site to open the app’s public url', true)
+		} catch (e: any) {
+			tab?.close()
+			sendUserToast('Could not open the public url: ' + (e?.body ?? e?.message ?? e), true)
+		}
+	}
+
 	$effect(() => {
 		if (workspace && path) loadPerms()
 	})
+
+	// Both of this page's buttons carry a label, and a phone's bar has room for neither beside the
+	// app's path — so below that width they become one menu. Unmeasured (0) counts as wide: the bar
+	// measures itself on mount, and starting compact would pop them out a frame later.
+	const compact = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR)
+	const compactItems: Item[] = $derived([
+		...(hasPublicUrl
+			? [
+					{
+						displayName: 'Public url',
+						icon: ExternalLink,
+						action: () => openPublicUrl()
+					}
+				]
+			: []),
+		{
+			displayName: 'Edit',
+			icon: Pen,
+			href: onEdit ? undefined : editHref,
+			action: onEdit ? () => onEdit() : undefined
+		}
+	])
 </script>
 
-<PublicAppFrame
-	{fetchEmbedToken}
-	{viewerUrl}
-	onViewerReady={(_token, requestTokenRefresh) => {
-		refresh = requestTokenRefresh
-		loadApp()
-	}}
->
-	{#snippet viewer()}
-		<PublicApp
-			{app}
-			{workspace}
-			user={appUser}
-			{notExists}
-			{noPermission}
-			jwtError={false}
-			inWorkspace
-			{hideRefreshBar}
-			{syncHashToUrl}
-			onLoginSuccess={() => loadApp()}
-		></PublicApp>
-	{/snippet}
-</PublicAppFrame>
+<div class="h-full">
+	<PublicAppFrame
+		{fetchEmbedToken}
+		{viewerUrl}
+		onViewerReady={(_token, requestTokenRefresh) => {
+			refresh = requestTokenRefresh
+			loadApp()
+		}}
+	>
+		{#snippet viewer()}
+			<PublicApp
+				{app}
+				{workspace}
+				user={appUser ?? $userStore}
+				{notExists}
+				{noPermission}
+				jwtError={false}
+				inWorkspace
+				{hideRefreshBar}
+				{syncHashToUrl}
+				onLoginSuccess={() => loadApp()}
+			></PublicApp>
+		{/snippet}
+	</PublicAppFrame>
+</div>
 
-{#if canWriteApp && !hideEditBtn}
-	<div id="app-edit-btn" class="absolute bottom-4 z-50 right-4">
-		<Button
-			size="sm"
-			startIcon={{ icon: Pen }}
-			variant="subtle"
-			href={onEdit ? undefined : editHref}
-			on:click={() => onEdit?.()}>Edit</Button
-		>
+<!-- The band names the app for whoever opened it, write access or not: the route alone registers
+     no item, and the breadcrumb would fall back to the section name "Apps". -->
+{#if ownsPageHeader}
+	<PageHeaderContent
+		item={{ kind: 'app', path }}
+		actions={showEdit && !menuHidden ? editAction : undefined}
+		separator="always"
+	/>
+{/if}
+
+<!-- Edit is the bar's action when this viewer owns the bar, and floats over the canvas otherwise:
+     an embed has no bar — it would cost the app 44px of the iframe to carry one button — and
+     inside a session's preview panel the bar belongs to the session, so an Edit up there would
+     sit beside the session's name and act on the panel below it. -->
+{#if showEdit && (menuHidden || !ownsPageHeader)}
+	<div class="absolute bottom-4 right-4 z-50">
+		{@render editAction()}
 	</div>
 {/if}
+
+{#snippet editAction()}
+	{#if compact}
+		<!-- Too little bar to seat both: they fold into one menu rather than losing their labels,
+		     which are what say where each one goes. -->
+		<DropdownV2 items={compactItems} placement="bottom-end" size="sm" />
+	{:else}
+		{#if hasPublicUrl}
+			<!-- The app on its own, at the url anyone it is shared with uses. A new tab rather than
+			     this one: the viewer here is the same app, so replacing it would look like nothing
+			     happened. The secret is fetched by the click, so the url exists only once asked for. -->
+			<Button
+				unifiedSize="sm"
+				variant="subtle"
+				startIcon={{ icon: ExternalLink }}
+				onclick={openPublicUrl}
+				title="Open the app's public url in a new tab">Public url</Button
+			>
+		{/if}
+		<!-- `onEdit` wins over the href: a host that embeds this viewer opens its own editor rather
+		     than navigating the frame to one. -->
+		<Button
+			unifiedSize="sm"
+			startIcon={{ icon: Pen }}
+			variant="default"
+			href={onEdit ? undefined : editHref}
+			on:click={() => onEdit?.()}
+			title="Edit this app"
+			id="app-edit-btn">Edit</Button
+		>
+	{/if}
+{/snippet}
diff --git a/frontend/src/lib/components/apps/editor/PreviewToggle.svelte b/frontend/src/lib/components/apps/editor/PreviewToggle.svelte
index 7a72ac62b3..4e20301043 100644
--- a/frontend/src/lib/components/apps/editor/PreviewToggle.svelte
+++ b/frontend/src/lib/components/apps/editor/PreviewToggle.svelte
@@ -8,9 +8,11 @@
 
 	interface Props {
 		loading?: boolean
+		/** Drops the two labels, for a bar with no room for them: the pen and the eye carry it. */
+		iconOnly?: boolean
 	}
 
-	let { loading = false }: Props = $props()
+	let { loading = false, iconOnly = false }: Props = $props()
 
 	const { mode, jobs, jobsById } = getContext<AppViewerContext>('AppViewerContext')
 </script>
@@ -24,7 +26,8 @@
 >
 	{#snippet children({ item })}
 		<ToggleButton
-			label="Editor"
+			label={iconOnly ? undefined : 'Editor'}
+			tooltip={iconOnly ? 'Editor mode' : undefined}
 			value="dnd"
 			icon={Pen}
 			disabled={loading}
@@ -33,7 +36,7 @@
 			{item}
 		/>
 		<ToggleButton
-			label="Preview"
+			label={iconOnly ? undefined : 'Preview'}
 			value="preview"
 			icon={Eye}
 			tooltip="Preview mode"
diff --git a/frontend/src/lib/components/apps/editor/PublicApp.svelte b/frontend/src/lib/components/apps/editor/PublicApp.svelte
index 58b6eaf838..64da63e727 100644
--- a/frontend/src/lib/components/apps/editor/PublicApp.svelte
+++ b/frontend/src/lib/components/apps/editor/PublicApp.svelte
@@ -1,28 +1,15 @@
 <script lang="ts">
 	import { applyDarkModeVariant } from '$lib/darkModeVariant'
-	import { enterpriseLicense, userStore, type UserExt } from '$lib/stores'
-	import { base } from '$app/paths'
-	import { page } from '$app/state'
-	import Login from '$lib/components/Login.svelte'
+	import type { UserExt } from '$lib/stores'
 	import { isCloudHosted } from '$lib/cloud'
-	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
 	import WindmillIcon from '$lib/components/icons/WindmillIcon.svelte'
-	import { getContext, setContext } from 'svelte'
-	import {
-		EMBED_NAV_CONTEXT_KEY,
-		IS_APP_PUBLIC_CONTEXT_KEY,
-		type EditorBreakpoint,
-		type EmbedNav
-	} from '../types'
-	import { UserService, type AppWithLastVersion, type GlobalWhoamiResponse } from '$lib/gen'
-	import { urlParamsToObject } from '$lib/utils'
-	import { goto } from '$app/navigation'
-	import { loadAppPreview } from './loadAppPreview'
+	import { setContext } from 'svelte'
+	import { IS_APP_PUBLIC_CONTEXT_KEY } from '../types'
+	import type { AppWithLastVersion } from '$lib/gen/types.gen'
 	import RawAppPreview from '$lib/components/raw_apps/RawAppPreview.svelte'
 	import type { Runnable } from '$lib/components/raw_apps/rawAppPolicy'
-	import { twMerge } from 'tailwind-merge'
-	import { writable } from 'svelte/store'
+	import { loadAppCss } from './publicAppApi'
 
 	let {
 		notExists,
@@ -33,6 +20,7 @@
 		app,
 		workspace,
 		user = undefined,
+		license = undefined,
 		inWorkspace = false,
 		hideRefreshBar = false,
 		syncHashToUrl = true
@@ -46,11 +34,13 @@
 		onLoginSuccess: () => void
 		app: (AppWithLastVersion & { value: any; workspace_id?: string }) | undefined
 		workspace: string | undefined
-		/** The viewer's membership in `workspace`, for the app's `ctx`. Without it `ctx` falls
-		 * back to `userStore`, which describes the workspace the page is navigated to — the
-		 * same one on every standalone viewer route, but not inside an AI session's preview
-		 * tab, where the app belongs to the session's workspace. */
+		/** The viewer's membership in `workspace`, for the app's `ctx`. Callers pass it
+		 * explicitly — `$userStore` describes the workspace the page is navigated to, which
+		 * is not the app's inside an AI session's preview tab. */
 		user?: UserExt | undefined
+		/** The instance license, which fades the "Powered by" badge and lets a low-code app's
+		 * custom CSS apply. */
+		license?: string | undefined
 		/**
 		 * In-workspace rendering (`/apps/get`, `/app_embed`): keep exact parity
 		 * with the pre-sandbox member viewer — no "Powered by Windmill" badge, no
@@ -65,23 +55,11 @@
 	// Use workspace from props or from app.workspace_id (for custom path responses)
 	let effectiveWorkspace = $derived(workspace ?? app?.workspace_id)
 
-	// `ctx.username` / `ctx.groups` are per-workspace, and they sit next to `ctx.workspace`
-	// in the same object, so they have to come from the same workspace it names.
-	let ctxUser = $derived(user ?? $userStore)
-
 	// On the public surfaces (untrusted distribution) runnable-authored html/svg needs
 	// the viewer's approval before it renders, unless the app sandbox isolates it. The
 	// in-workspace viewer renders it verbatim. See getAppMarkupTrust.
 	setContext(IS_APP_PUBLIC_CONTEXT_KEY, !inWorkspace)
 
-	// WIN-2006: inside the opaque viewer iframe, navigations to other routes
-	// (navbar "app" items) must happen on the TOP page — the iframe is cookieless,
-	// so navigating it would just show a login screen. PublicAppFrame provides the
-	// relay; outside the opaque viewer this is undefined and goto works directly.
-	const embedNav = getContext<EmbedNav | undefined>(EMBED_NAV_CONTEXT_KEY)
-
-	const breakpoint = writable<EditorBreakpoint>('lg')
-
 	const darkMode =
 		window.localStorage.getItem('dark-mode') ??
 		(window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light')
@@ -93,135 +71,75 @@
 	}
 	// This route bypasses the (root) layout, so restore the variant class too.
 	applyDarkModeVariant()
-
-	let globalUser = $state<GlobalWhoamiResponse | undefined>(undefined)
-	async function loadGlobalUser() {
-		try {
-			globalUser = await UserService.globalWhoami()
-		} catch (error) {
-			console.error(error)
-		}
-		// const user = await fetch('/api/global/user')
-		// console.log(user)
-	}
-
-	// Only the no-access page reads it, to tell a signed-in non-member which
-	// workspace the app belongs to.
-	$effect(() => {
-		if (noPermission && !guestAppPath && !$userStore && !globalUser) {
-			loadGlobalUser()
-		}
-	})
 </script>
 
+<!-- Only the raw-app branch is imported statically: everything else waits for app.css and
+     its own chunk, see publicAppApi.ts. -->
 {#if !inWorkspace}
-	<div
-		class="z-50 text-xs fixed bottom-1 right-2 {$enterpriseLicense && !isCloudHosted()
-			? 'transition-opacity delay-1000 duration-1000 opacity-20 hover:delay-0 hover:opacity-100'
-			: ''}"
-	>
-		<a href="https://windmill.dev" class="whitespace-nowrap text-primary inline-flex items-center"
-			>Powered by &nbsp;<WindmillIcon />&nbsp;Windmill</a
+	{#await loadAppCss() then}
+		<div
+			class="z-50 text-xs fixed bottom-1 right-2 {license && !isCloudHosted()
+				? 'transition-opacity delay-1000 duration-1000 opacity-20 hover:delay-0 hover:opacity-100'
+				: ''}"
 		>
-	</div>
+			<a href="https://windmill.dev" class="whitespace-nowrap text-primary inline-flex items-center"
+				>Powered by &nbsp;<WindmillIcon />&nbsp;Windmill</a
+			>
+		</div>
+	{/await}
 {/if}
 
-{#if notExists}
-	<div class="px-4 mt-20"
-		><Alert type="error" title="Not found"
-			>There was an error loading the app, is the url correct? <a href={base}>Go to Windmill</a>
-		</Alert></div
-	>
-{:else if noPermission}
-	{#if guestAppPath && !$userStore}
-		<div class="px-4 mt-20 w-full text-center font-bold text-xl"> Sign in to open this app </div>
-		<div class="text-center mt-8 text-sm text-primary">
-			You do not need a Windmill account. Signing in lets you open this app and nothing else.
-		</div>
-	{:else}
-		<div class="px-4 mt-20 w-full text-center font-bold text-xl">
-			This app requires read access
-		</div>
-		<div class="text-center mt-8 text-sm text-primary">
-			{#if $userStore}You are logged in but have no read access to this app{:else if globalUser && effectiveWorkspace}
-				You are logged in but are not a member of the workspace <span class="text-xl font-bold"
-					>{effectiveWorkspace}</span
-				> this app is part of
-			{:else}You must be logged in and have read access to this app{/if}</div
-		>
-	{/if}
-	<div class="px-2 mx-auto mt-20 max-w-xl w-full">
-		{#if !jwtError}
-			<Login
-				{onLoginSuccess}
-				popup
-				guestApp={guestAppPath}
-				rd={page.url.pathname + page.url.search + page.url.hash}
-			/>
-		{/if}
-	</div>
+{#if notExists || noPermission}
+	{#await Promise.all([loadAppCss(), import('./PublicAppAccess.svelte')]) then [, { default: PublicAppAccess }]}
+		<PublicAppAccess
+			{notExists}
+			{jwtError}
+			{guestAppPath}
+			{user}
+			workspace={effectiveWorkspace}
+			{onLoginSuccess}
+		/>
+	{/await}
 {:else if app}
 	{#key app}
 		{#if app.raw_app && effectiveWorkspace}
-			<RawAppPreview
-				workspace={effectiveWorkspace}
-				user={ctxUser}
-				secret={app.bundle_secret}
-				path={app.path}
-				runnables={(app.value?.runnables ?? {}) as Record<string, Runnable>}
-				{syncHashToUrl}
-			/>
+			<!-- The bundle's iframe is full-height, so every host has to give this box a height to
+			     resolve against: in the workspace the layout hands one down, and the share, embed
+			     and custom-path routes floor themselves at the viewport. An iframe with no height
+			     above it falls back to 150px. Styled inline: app.css may not be loaded here. -->
+			<div style="height: 100%; width: 100%">
+				<RawAppPreview
+					workspace={effectiveWorkspace}
+					{user}
+					secret={app.bundle_secret}
+					path={app.path}
+					runnables={(app.value?.runnables ?? {}) as Record<string, Runnable>}
+					{syncHashToUrl}
+				/>
+			</div>
 		{:else if app.raw_app && !effectiveWorkspace}
-			<div class="px-4 mt-20">
-				<Alert type="error" title="Configuration error">
-					Unable to load raw app: workspace information is missing.
-				</Alert>
-			</div>
+			{#await Promise.all([loadAppCss(), import('$lib/components/common/alert/Alert.svelte')]) then [, { default: Alert }]}
+				<div class="px-4 mt-20">
+					<Alert type="error" title="Configuration error">
+						Unable to load raw app: workspace information is missing.
+					</Alert>
+				</div>
+			{/await}
 		{:else}
-			<div
-				class={twMerge(
-					// `flex-col` matches the pre-sandbox in-workspace viewer exactly;
-					// the public viewer always used a plain `flex` wrapper.
-					inWorkspace
-						? 'min-h-screen h-full w-full flex flex-col'
-						: 'min-h-screen h-full w-full flex',
-					app?.value?.['css']?.['app']?.['viewer']?.class,
-					'wm-app-viewer'
-				)}
-				style={app?.value?.['css']?.['app']?.['viewer']?.style}
-			>
-				{#await loadAppPreview()}
-					<Skeleton layout={[[4], 0.5, [50]]} />
-				{:then Module}
-					<Module.default
-						noBackend={false}
-						{hideRefreshBar}
-						context={{
-							email: ctxUser?.email,
-							name: ctxUser?.name,
-							groups: ctxUser?.groups,
-							username: ctxUser?.username,
-							query: urlParamsToObject(page.url.searchParams, { stripReserved: true }),
-							hash: page.url.hash.substring(1)
-						}}
-						workspace={effectiveWorkspace}
-						summary={app.summary}
-						app={app.value}
-						appPath={app.path}
-						{breakpoint}
-						policy={app.policy}
-						isEditor={false}
-						replaceStateFn={(path) => goto(path)}
-						gotoFn={(path, opt) => (embedNav ? embedNav.navigateTop(path) : goto(path, opt))}
-					/>
-				{:catch}
-					<div class="px-4 mt-20 w-full">
-						<Alert type="error" title="Could not load the app">Reload the page to try again.</Alert>
-					</div>
-				{/await}
-			</div>
+			{#await Promise.all([loadAppCss(), import('./PublicLowCodeApp.svelte')]) then [, { default: PublicLowCodeApp }]}
+				<PublicLowCodeApp
+					{app}
+					workspace={effectiveWorkspace}
+					{user}
+					{license}
+					{inWorkspace}
+					{hideRefreshBar}
+				/>
+			{/await}
 		{/if}
 	{/key}
 {:else}
-	<Skeleton layout={[[4], 0.5, [50]]} />
+	{#await loadAppCss() then}
+		<Skeleton layout={[[4], 0.5, [50]]} />
+	{/await}
 {/if}
diff --git a/frontend/src/lib/components/apps/editor/PublicAppAccess.svelte b/frontend/src/lib/components/apps/editor/PublicAppAccess.svelte
new file mode 100644
index 0000000000..9a993b4972
--- /dev/null
+++ b/frontend/src/lib/components/apps/editor/PublicAppAccess.svelte
@@ -0,0 +1,81 @@
+<script lang="ts">
+	import { base } from '$app/paths'
+	import { page } from '$app/state'
+	import Login from '$lib/components/Login.svelte'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import { UserService, type GlobalWhoamiResponse } from '$lib/gen'
+	import type { UserExt } from '$lib/stores'
+	import { dropPrefetched } from './publicAppApi'
+
+	let {
+		notExists,
+		jwtError,
+		guestAppPath,
+		user,
+		workspace,
+		onLoginSuccess
+	}: {
+		notExists: boolean
+		jwtError: boolean
+		guestAppPath: string | undefined
+		user: UserExt | undefined
+		workspace: string | undefined
+		onLoginSuccess: () => void
+	} = $props()
+
+	let globalUser = $state<GlobalWhoamiResponse | undefined>(undefined)
+	async function loadGlobalUser() {
+		try {
+			globalUser = await UserService.globalWhoami()
+		} catch (error) {
+			console.error(error)
+		}
+	}
+
+	// Only the no-access page reads it, to tell a signed-in non-member which
+	// workspace the app belongs to.
+	$effect(() => {
+		if (!notExists && !guestAppPath && !user && !globalUser) {
+			loadGlobalUser()
+		}
+	})
+</script>
+
+{#if notExists}
+	<div class="px-4 mt-20"
+		><Alert type="error" title="Not found"
+			>There was an error loading the app, is the url correct? <a href={base}>Go to Windmill</a>
+		</Alert></div
+	>
+{:else}
+	{#if guestAppPath && !user}
+		<div class="px-4 mt-20 w-full text-center font-bold text-xl"> Sign in to open this app </div>
+		<div class="text-center mt-8 text-sm text-primary">
+			You do not need a Windmill account. Signing in lets you open this app and nothing else.
+		</div>
+	{:else}
+		<div class="px-4 mt-20 w-full text-center font-bold text-xl">
+			This app requires read access
+		</div>
+		<div class="text-center mt-8 text-sm text-primary">
+			{#if user}You are logged in but have no read access to this app{:else if globalUser && workspace}
+				You are logged in but are not a member of the workspace <span class="text-xl font-bold"
+					>{workspace}</span
+				> this app is part of
+			{:else}You must be logged in and have read access to this app{/if}</div
+		>
+	{/if}
+	<div class="px-2 mx-auto mt-20 max-w-xl w-full">
+		{#if !jwtError}
+			<Login
+				onLoginSuccess={() => {
+					dropPrefetched()
+					onLoginSuccess()
+				}}
+				popup
+				guestApp={guestAppPath}
+				rd={page.url.pathname + page.url.search + page.url.hash}
+			/>
+		{/if}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte b/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte
index e994767488..dbb9b4b88b 100644
--- a/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte
+++ b/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte
@@ -23,19 +23,43 @@
 	 * bearer token (no cookie); the raw wrapper document always carries `CSP: sandbox`.
 	 */
 	import { BROWSER } from 'esm-env'
-	import { OpenAPI, UserService } from '$lib/gen'
+	import { OpenAPI } from '$lib/gen/core/OpenAPI'
 	import { page } from '$app/state'
 	import { onDestroy, onMount, setContext, type Snippet } from 'svelte'
-	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
 	import { base } from '$app/paths'
 	import { goto } from '$app/navigation'
-	import Login from '$lib/components/Login.svelte'
-	import { WINDMILL_RESERVED_QUERY_PARAMS } from '$lib/utils'
+	import { WINDMILL_RESERVED_QUERY_PARAMS } from '$lib/utils/queryParams'
 	import { EMBED_NAV_CONTEXT_KEY, type EmbedNav } from '../types'
 	import { loadAppPreview } from './loadAppPreview'
-	import RawAppSdkConsent from '$lib/components/raw_apps/RawAppSdkConsent.svelte'
-	import { hasStoredSdkConsent, storeSdkConsent } from '$lib/components/raw_apps/sdkScopes'
+	import { dropPrefetched, loadAppCss } from './publicAppApi'
+	import {
+		hasStoredSdkConsent,
+		sdkConsentCovers,
+		storeSdkConsent
+	} from '$lib/components/raw_apps/sdkScopes'
+
+	// Everything but a rendered app (sign-in, errors, the SDK consent prompt) loads on
+	// demand: a raw app that renders right away needs none of it. See publicAppApi.ts.
+	let frameUi:
+		| Promise<{
+				Alert: typeof import('$lib/components/common/alert/Alert.svelte').default
+				Login: typeof import('$lib/components/Login.svelte').default
+				RawAppSdkConsent: typeof import('$lib/components/raw_apps/RawAppSdkConsent.svelte').default
+		  }>
+		| undefined
+	function loadFrameUi() {
+		return (frameUi ??= Promise.all([
+			loadAppCss(),
+			import('$lib/components/common/alert/Alert.svelte'),
+			import('$lib/components/Login.svelte'),
+			import('$lib/components/raw_apps/RawAppSdkConsent.svelte')
+		]).then(([, alert, login, consent]) => ({
+			Alert: alert.default,
+			Login: login.default,
+			RawAppSdkConsent: consent.default
+		})))
+	}
 
 	type EmbedToken = {
 		token?: string | null
@@ -231,7 +255,8 @@
 		if (offerSignIn && accountSession === 'unknown') {
 			// Workspace-less, so it answers for an account and never for a guest
 			// (pinned to its workspace) or for nobody.
-			UserService.getCurrentEmail()
+			import('$lib/gen')
+				.then(({ UserService }) => UserService.getCurrentEmail())
 				.then(() => (accountSession = 'held'))
 				.catch(() => (accountSession = 'none'))
 		}
@@ -245,8 +270,12 @@
 	let staleGuestLogoutFailed = $state(false)
 	$effect(() => {
 		if (deniedStatus === 403 && guestEntry === 'guest' && !staleGuestCleared) {
-			UserService.logout()
-				.then(() => (staleGuestCleared = true))
+			import('$lib/gen')
+				.then(({ UserService }) => UserService.logout())
+				.then(() => {
+					dropPrefetched()
+					staleGuestCleared = true
+				})
 				.catch(() => (staleGuestLogoutFailed = true))
 		}
 	})
@@ -388,7 +417,7 @@
 			appPath = resp.app_path ?? appPath
 			workspaceId = resp.workspace_id ?? workspaceId
 			const granted = resp.sdk_scopes ?? []
-			if (!granted.every((s) => approved.includes(s))) {
+			if (!sdkConsentCovers(approved, granted)) {
 				// The app was redeployed with more scopes between the prompt and the
 				// mint. Never inject a token carrying scopes the viewer wasn't shown:
 				// drop it and ask again with the new set.
@@ -423,7 +452,10 @@
 			// Render the app directly on this origin: same-origin when unsandboxed
 			// (the default), or a single opaque bundle iframe when it's a sandboxed
 			// raw app. A low-code app's runtime downloads alongside the app payload.
-			if (!isRaw) loadAppPreview().catch(() => {})
+			if (!isRaw) {
+				loadAppCss().catch(() => {})
+				loadAppPreview().catch(() => {})
+			}
 			onViewerReady?.(undefined, requestTokenRefresh)
 		} else {
 			// Sandboxed low-code: hand the scoped token to the opaque viewer iframe.
@@ -533,6 +565,7 @@
 	onMount(() => {
 		if (isViewer) {
 			// Only a sandboxed low-code app is ever framed as a viewer.
+			loadAppCss().catch(() => {})
 			loadAppPreview().catch(() => {})
 			window.addEventListener('message', handleViewerMessage)
 			installHashRelay()
@@ -565,105 +598,120 @@
 	{#if viewerReady}
 		{@render viewer()}
 	{:else if viewerOrphaned}
-		<div class="px-4 mt-20 max-w-xl mx-auto">
-			<Alert type="info" title="Open this app from Windmill">
-				This is a Windmill app viewer and must be loaded by Windmill. If you embedded it in your own
-				page, use the app's public URL without the <code>wm_embed</code> parameter.
-			</Alert>
-		</div>
+		{#await loadFrameUi() then { Alert }}
+			<div class="px-4 mt-20 max-w-xl mx-auto">
+				<Alert type="info" title="Open this app from Windmill">
+					This is a Windmill app viewer and must be loaded by Windmill. If you embedded it in your
+					own page, use the app's public URL without the <code>wm_embed</code> parameter.
+				</Alert>
+			</div>
+		{/await}
 	{:else}
-		<Skeleton layout={[[4], 0.5, [50]]} />
+		{#await loadAppCss() then}
+			<Skeleton layout={[[4], 0.5, [50]]} />
+		{/await}
 	{/if}
 {:else if status === 'loading'}
-	<Skeleton layout={[[4], 0.5, [50]]} />
-{:else if status === 'notExists' && !offerSignIn}
-	<div class="px-4 mt-20">
-		<Alert type="error" title="Not found">
-			There was an error loading the app, is the url correct?
-			<a href={base}>Go to Windmill</a>
-		</Alert>
-	</div>
-{:else if status === 'sdkPrompt'}
-	<!-- Raw-app frontend SDK: ask before the app's code runs, so the viewer sees
-	     what it will be able to do with their identity. -->
-	<RawAppSdkConsent
-		scopes={sdkScopes ?? []}
-		onContinue={onSdkConsentContinue}
-		onDecline={onSdkConsentDecline}
-	/>
-{:else if offerSignIn && (guestEntry === 'pending' || accountSession === 'unknown' || (deniedStatus === 403 && guestEntry === 'guest' && !staleGuestCleared && !staleGuestLogoutFailed))}
-	<Skeleton layout={[[4], 0.5, [50]]} />
-{:else if offerSignIn && (guestEntry === 'error' || staleGuestLogoutFailed)}
-	<div class="px-4 mt-20">
-		<Alert type="error" title="Could not check access">
-			The app could not be reached to find out who may open it. Reload to try again.
-		</Alert>
-	</div>
-{:else if offerSignIn}
-	<!-- Login happens here, on the embedder (main) window, so the session cookie
-	     is set on the main origin only and never reaches the opaque iframe. -->
-	{#if signInDidNotHelp}
-		<!-- Offering the same sign-in again would loop: they are signed in, and this
-		     app still will not open for them. Say why and stop. -->
-		<div class="px-4 mt-20 w-full text-center font-bold text-xl">
-			You are signed in, but this app is not open to you
-		</div>
-		<div class="text-center mt-8 text-sm text-primary">
-			It is open to the people it was shared with{guestAppPath
-				? ', and to guests who have no Windmill account'
-				: ''}. Ask the person who shared it to give your account access.
-		</div>
+	{#await loadAppCss() then}
+		<Skeleton layout={[[4], 0.5, [50]]} />
+	{/await}
+{:else if status === 'ready'}
+	{#if unsandboxed}
+		<!-- Same-origin (full session): the app was not opted into sandbox isolation
+		     (the default). Rendered directly here; RawAppPreview reads
+		     IS_APP_UNSANDBOXED to drop the bundle's opaque sandbox. -->
+		{@render viewer()}
+	{:else if isRaw}
+		<!-- Variant A: sandboxed raw app rendered directly on the real origin. The
+		     untrusted author bundle stays isolated in its own opaque iframe (inside
+		     RawAppPreview); no opaque viewer and no embed token are needed. -->
+		{@render viewer()}
 	{:else}
-		{#if guestAppPath}
-			<div class="px-4 mt-20 w-full text-center font-bold text-xl">Sign in to open this app</div>
-			<div class="text-center mt-8 text-sm text-primary">
-				You do not need a Windmill account. Signing in lets you open this app and nothing else.
-			</div>
-		{:else}
-			<div class="px-4 mt-20 w-full text-center font-bold text-xl">
-				This app requires read access
-			</div>
-		{/if}
-		{#if signInError}
-			<div class="px-2 mx-auto mt-8 max-w-xl w-full">
-				<Alert type="error" title="Could not sign you in">{signInError}</Alert>
-			</div>
-		{/if}
-		<div class="px-2 mx-auto mt-20 max-w-xl w-full">
-			<Login
-				onLoginSuccess={() => {
-					signInError = undefined
-					accountSession = 'unknown'
-					initEmbedder()
-				}}
-				onLoginError={(message) => (signInError = message)}
-				popup
-				guestApp={guestAppPath}
-				rd={page.url.pathname + page.url.search + page.url.hash}
-			/>
-		</div>
+		<!-- referrerpolicy: the embedder page URL can carry a viewer credential (the
+		     JWT path segment of share links); without this, the same-origin iframe
+		     navigation would expose it to app-authored code via document.referrer.
+		     Styled inline: it can render before app.css has loaded. -->
+		<iframe
+			bind:this={iframeEl}
+			src={buildViewerUrl()}
+			title="App"
+			style="display: block; width: 100%; height: 100%; border: 0"
+			sandbox="allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-downloads allow-modals allow-top-navigation"
+			allow="clipboard-read; clipboard-write; fullscreen"
+			referrerpolicy="no-referrer"
+		></iframe>
 	{/if}
-{:else if unsandboxed}
-	<!-- Same-origin (full session): the app was not opted into sandbox isolation
-	     (the default). Rendered directly here; RawAppPreview reads
-	     IS_APP_UNSANDBOXED to drop the bundle's opaque sandbox. -->
-	{@render viewer()}
-{:else if isRaw}
-	<!-- Variant A: sandboxed raw app rendered directly on the real origin. The
-	     untrusted author bundle stays isolated in its own opaque iframe (inside
-	     RawAppPreview); no opaque viewer and no embed token are needed. -->
-	{@render viewer()}
 {:else}
-	<!-- referrerpolicy: the embedder page URL can carry a viewer credential (the
-	     JWT path segment of share links); without this, the same-origin iframe
-	     navigation would expose it to app-authored code via document.referrer. -->
-	<iframe
-		bind:this={iframeEl}
-		src={buildViewerUrl()}
-		title="App"
-		class="w-full h-screen border-0 block"
-		sandbox="allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-downloads allow-modals allow-top-navigation"
-		allow="clipboard-read; clipboard-write; fullscreen"
-		referrerpolicy="no-referrer"
-	></iframe>
+	{#await loadFrameUi() then { Alert, Login, RawAppSdkConsent }}
+		{#if status === 'notExists' && !offerSignIn}
+			<div class="px-4 mt-20">
+				<Alert type="error" title="Not found">
+					There was an error loading the app, is the url correct?
+					<a href={base}>Go to Windmill</a>
+				</Alert>
+			</div>
+		{:else if status === 'sdkPrompt'}
+			<!-- Raw-app frontend SDK: ask before the app's code runs, so the viewer sees
+	     what it will be able to do with their identity. -->
+			<RawAppSdkConsent
+				scopes={sdkScopes ?? []}
+				onContinue={onSdkConsentContinue}
+				onDecline={onSdkConsentDecline}
+			/>
+		{:else if offerSignIn && (guestEntry === 'pending' || accountSession === 'unknown' || (deniedStatus === 403 && guestEntry === 'guest' && !staleGuestCleared && !staleGuestLogoutFailed))}
+			<Skeleton layout={[[4], 0.5, [50]]} />
+		{:else if offerSignIn && (guestEntry === 'error' || staleGuestLogoutFailed)}
+			<div class="px-4 mt-20">
+				<Alert type="error" title="Could not check access">
+					The app could not be reached to find out who may open it. Reload to try again.
+				</Alert>
+			</div>
+		{:else if offerSignIn}
+			<!-- Login happens here, on the embedder (main) window, so the session cookie
+	     is set on the main origin only and never reaches the opaque iframe. -->
+			{#if signInDidNotHelp}
+				<!-- Offering the same sign-in again would loop: they are signed in, and this
+		     app still will not open for them. Say why and stop. -->
+				<div class="px-4 mt-20 w-full text-center font-bold text-xl">
+					You are signed in, but this app is not open to you
+				</div>
+				<div class="text-center mt-8 text-sm text-primary">
+					It is open to the people it was shared with{guestAppPath
+						? ', and to guests who have no Windmill account'
+						: ''}. Ask the person who shared it to give your account access.
+				</div>
+			{:else}
+				{#if guestAppPath}
+					<div class="px-4 mt-20 w-full text-center font-bold text-xl">Sign in to open this app</div
+					>
+					<div class="text-center mt-8 text-sm text-primary">
+						You do not need a Windmill account. Signing in lets you open this app and nothing else.
+					</div>
+				{:else}
+					<div class="px-4 mt-20 w-full text-center font-bold text-xl">
+						This app requires read access
+					</div>
+				{/if}
+				{#if signInError}
+					<div class="px-2 mx-auto mt-8 max-w-xl w-full">
+						<Alert type="error" title="Could not sign you in">{signInError}</Alert>
+					</div>
+				{/if}
+				<div class="px-2 mx-auto mt-20 max-w-xl w-full">
+					<Login
+						onLoginSuccess={() => {
+							dropPrefetched()
+							signInError = undefined
+							accountSession = 'unknown'
+							initEmbedder()
+						}}
+						onLoginError={(message) => (signInError = message)}
+						popup
+						guestApp={guestAppPath}
+						rd={page.url.pathname + page.url.search + page.url.hash}
+					/>
+				</div>
+			{/if}
+		{/if}
+	{/await}
 {/if}
diff --git a/frontend/src/lib/components/apps/editor/PublicLowCodeApp.svelte b/frontend/src/lib/components/apps/editor/PublicLowCodeApp.svelte
new file mode 100644
index 0000000000..f74be67166
--- /dev/null
+++ b/frontend/src/lib/components/apps/editor/PublicLowCodeApp.svelte
@@ -0,0 +1,91 @@
+<script lang="ts">
+	import { goto } from '$app/navigation'
+	import { page } from '$app/state'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
+	import type { AppWithLastVersion } from '$lib/gen'
+	import { enterpriseLicense, userStore, type UserExt } from '$lib/stores'
+	import { urlParamsToObject } from '$lib/utils'
+	import { getContext } from 'svelte'
+	import { writable } from 'svelte/store'
+	import { twMerge } from 'tailwind-merge'
+	import { EMBED_NAV_CONTEXT_KEY, type EditorBreakpoint, type EmbedNav } from '../types'
+	import { loadAppPreview } from './loadAppPreview'
+
+	let {
+		app,
+		workspace,
+		user,
+		license,
+		inWorkspace,
+		hideRefreshBar
+	}: {
+		app: AppWithLastVersion & { value: any }
+		workspace: string | undefined
+		user: UserExt | undefined
+		license: string | undefined
+		inWorkspace: boolean
+		hideRefreshBar: boolean
+	} = $props()
+
+	// The public routes hold the viewer and license as props, while low-code components
+	// read them from the stores (the license gates the app's custom CSS, for one).
+	$effect(() => {
+		if (inWorkspace) return
+		userStore.set(user)
+		if (license) enterpriseLicense.set(license)
+	})
+
+	// WIN-2006: inside the opaque viewer iframe, navigations to other routes
+	// (navbar "app" items) must happen on the TOP page — the iframe is cookieless,
+	// so navigating it would just show a login screen. PublicAppFrame provides the
+	// relay; outside the opaque viewer this is undefined and goto works directly.
+	const embedNav = getContext<EmbedNav | undefined>(EMBED_NAV_CONTEXT_KEY)
+
+	const breakpoint = writable<EditorBreakpoint>('lg')
+</script>
+
+<div
+	class={twMerge(
+		// `flex-col` matches the pre-sandbox in-workspace viewer exactly;
+		// the public viewer always used a plain `flex` wrapper. `min-h-full`, not
+		// `h-full`: the box has to reach the bottom of what the host gives it so the
+		// app's own background covers the window, and still grow with a grid taller
+		// than that. A viewport floor instead would overhang the page box by the
+		// height of the page header band.
+		inWorkspace ? 'min-h-full w-full flex flex-col' : 'min-h-full w-full flex',
+		app?.value?.['css']?.['app']?.['viewer']?.class,
+		'wm-app-viewer'
+	)}
+	style={app?.value?.['css']?.['app']?.['viewer']?.style}
+>
+	{#await loadAppPreview()}
+		<Skeleton layout={[[4], 0.5, [50]]} />
+	{:then Module}
+		<Module.default
+			noBackend={false}
+			{hideRefreshBar}
+			context={{
+				email: user?.email,
+				name: user?.name,
+				groups: user?.groups,
+				username: user?.username,
+				query: urlParamsToObject(page.url.searchParams, { stripReserved: true }),
+				hash: page.url.hash.substring(1)
+			}}
+			{workspace}
+			summary={app.summary}
+			app={app.value}
+			appPath={app.path}
+			{breakpoint}
+			policy={app.policy}
+			isEditor={false}
+			replaceStateFn={(path) => goto(path)}
+			gotoFn={(path, opt) => (embedNav ? embedNav.navigateTop(path) : goto(path, opt))}
+		/>
+	{:catch}
+		<div class="px-4 mt-20 w-full">
+			<Alert type="error" title="Could not load the app">Reload the page to try again.</Alert>
+		</div>
+	{/await}
+</div>
diff --git a/frontend/src/lib/components/apps/editor/publicAppApi.ts b/frontend/src/lib/components/apps/editor/publicAppApi.ts
new file mode 100644
index 0000000000..674cb0b622
--- /dev/null
+++ b/frontend/src/lib/components/apps/editor/publicAppApi.ts
@@ -0,0 +1,82 @@
+// The public app routes (`/public/...`, `/a/...`) render a raw app as little more than its
+// bundle's iframe, so they must not statically import the generated client, `$lib/stores`
+// or `$lib/utils`: each drags in most of the app shell. `vite.config.js`
+// (`assertLeanPublicAppRoutes`) fails the build if they do. Anything heavier is imported
+// lazily by the branch that needs it.
+import { OpenAPI } from '$lib/gen/core/OpenAPI'
+import type { AppWithLastVersion, User } from '$lib/gen/types.gen'
+import type { UserExt } from '$lib/stores'
+import { mapUserToUserExt } from '$lib/userExt'
+
+export type PublicAppValue = AppWithLastVersion & { value: any; workspace_id?: string }
+
+declare global {
+	interface Window {
+		/** Responses `app.html` requested before any module loaded, keyed by URL. */
+		__wmPublicAppPrefetch?: Record<string, Promise<Response>>
+	}
+}
+
+/** Carries `status` like the generated client's `ApiError`, which callers branch on. */
+export class PublicApiError extends Error {
+	constructor(public status: number) {
+		super(`Request failed with status ${status}`)
+	}
+}
+
+/** Prefetched responses answer for the credential the page loaded with; call this when it
+ * changes (a sign-in or logout on the page) so later reads go to the network. */
+export function dropPrefetched(): void {
+	delete window.__wmPublicAppPrefetch
+}
+
+function takePrefetched(url: string): Promise<Response> | undefined {
+	const prefetched = window.__wmPublicAppPrefetch
+	const res = prefetched?.[url]
+	if (res) delete prefetched![url]
+	return res
+}
+
+/** GET an API path with the page credential: the bearer token in `OpenAPI.TOKEN` when the
+ * share link carries one, the session cookie otherwise. A prefetched response is only
+ * taken in the cookie case, which is the only credential `app.html` sends. */
+export async function publicGet<T>(path: string): Promise<T> {
+	const url = `${OpenAPI.BASE}${path}`
+	const token = typeof OpenAPI.TOKEN === 'string' && OpenAPI.TOKEN ? OpenAPI.TOKEN : undefined
+	const res = await ((!token && takePrefetched(url)) ||
+		fetch(url, {
+			// As the generated client does: the opaque viewer frame is cross-origin to the
+			// API, whose `Access-Control-Allow-Origin: *` refuses a credentialed request.
+			credentials: OpenAPI.WITH_CREDENTIALS ? OpenAPI.CREDENTIALS : undefined,
+			headers: token ? { Authorization: `Bearer ${token}` } : {}
+		}))
+	if (!res.ok) throw new PublicApiError(res.status)
+	return (res.headers.get('content-type')?.includes('json') ? res.json() : res.text()) as T
+}
+
+export async function getUserExtOrUndefined(workspace: string): Promise<UserExt | undefined> {
+	try {
+		return mapUserToUserExt(
+			await publicGet<User>(`/w/${encodeURI(workspace)}/users/whoami`),
+			workspace
+		)
+	} catch {
+		return undefined
+	}
+}
+
+/** Only fades the "Powered by" badge, so a failure is not worth surfacing. */
+export async function getLicenseOrUndefined(): Promise<string | undefined> {
+	try {
+		return (await publicGet<string>('/ee_license')) || undefined
+	} catch {
+		return undefined
+	}
+}
+
+let appCss: Promise<unknown> | undefined
+/** The app-wide stylesheet, which these routes need only off the raw-app path: sign-in,
+ * errors, skeletons and low-code apps. A raw app's bundle brings its own styles. */
+export function loadAppCss(): Promise<unknown> {
+	return (appCss ??= import('$lib/assets/app.css'))
+}
diff --git a/frontend/src/lib/components/apps/types.ts b/frontend/src/lib/components/apps/types.ts
index 75de2d7faf..a72d54507e 100644
--- a/frontend/src/lib/components/apps/types.ts
+++ b/frontend/src/lib/components/apps/types.ts
@@ -188,6 +188,8 @@ export interface AppEditorProps {
 	// with its author and time. `version` and `head` differ when another deploy landed
 	// beside this one, which is when the out-of-date prompt has something to say.
 	onDeploy?: (e: { version?: number; head?: number; headBy?: string; headAt?: string }) => void
+	/** True for the route's own editor: its top bar becomes the page header. */
+	ownsPageHeader?: boolean
 }
 
 export type App = {
diff --git a/frontend/src/lib/components/assets/AssetGraph/AddDataSourceMenu.svelte b/frontend/src/lib/components/assets/AssetGraph/AddDataSourceMenu.svelte
new file mode 100644
index 0000000000..49a222148b
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/AddDataSourceMenu.svelte
@@ -0,0 +1,150 @@
+<!--
+@component
+The menu that adds a pipeline script started by a data source (a schedule, a
+webhook, a queue…): the add node's, and the canvas's right-click one.
+-->
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+	import PipelineInsertMenu, {
+		type PipelineInsertOptions,
+		type PipelineInsertPick
+	} from './PipelineInsertMenu.svelte'
+	import {
+		Clock,
+		Webhook,
+		Mail,
+		Zap,
+		Radio,
+		MessageSquare,
+		Database,
+		Send,
+		CloudCog,
+		Upload
+	} from 'lucide-svelte'
+	import type { ScriptLang } from '$lib/gen'
+	import type { NativeTriggerKind } from './types'
+	import { PIPELINE_LANGUAGES } from './pipelineLanguages'
+	import type { PipelineOutputKind } from './pipelineTemplates'
+
+	interface Props {
+		onAddPipelineScript: (
+			language: ScriptLang,
+			path: string,
+			source: { kind: NativeTriggerKind; path: string | undefined },
+			outputKind: PipelineOutputKind,
+			aiPrompt?: string,
+			options?: PipelineInsertOptions
+		) => void
+		pathPrefix: string
+		defaultPathSuffix: string
+		trigger: Snippet<[{ open: boolean }]>
+		/** Opens the menu each time it changes. */
+		openSignal?: number
+	}
+	let {
+		onAddPipelineScript,
+		pathPrefix,
+		defaultPathSuffix,
+		trigger,
+		openSignal
+	}: Props = $props()
+
+	function handlePick(pick: PipelineInsertPick) {
+		if (!pick.language || !pick.path) return
+		// Native trigger annotation is marker-only — the binding lives on the
+		// trigger row's own `script_path`, which is created separately.
+		onAddPipelineScript(
+			pick.language as ScriptLang,
+			pick.path,
+			{ kind: pick.kindId as NativeTriggerKind, path: undefined },
+			(pick.outputKind ?? 'none') as PipelineOutputKind,
+			pick.aiPrompt,
+			{ schedule: pick.schedule, outputAsset: pick.outputAsset }
+		)
+	}
+</script>
+
+<PipelineInsertMenu
+	kinds={[
+		{
+			id: 'data_upload',
+			label: 'On data upload',
+			description: 'UI-first: run by uploading a file via the S3 picker',
+			icon: Upload
+		},
+		{
+			id: 'schedule',
+			label: 'On schedule',
+			description: 'Triggered by a schedule you create',
+			icon: Clock
+		},
+		{
+			id: 'webhook',
+			label: 'On webhook',
+			description: 'Triggered by an HTTP webhook',
+			icon: Webhook
+		},
+		{
+			id: 'email',
+			configuredAfterCreate: true,
+			label: 'On email',
+			description: 'Triggered by incoming email',
+			icon: Mail
+		},
+		{
+			id: 'kafka',
+			configuredAfterCreate: true,
+			label: 'On Kafka',
+			description: 'Triggered by a Kafka message',
+			icon: Zap
+		},
+		{
+			id: 'mqtt',
+			configuredAfterCreate: true,
+			label: 'On MQTT',
+			description: 'Triggered by an MQTT message',
+			icon: Radio
+		},
+		{
+			id: 'amqp',
+			configuredAfterCreate: true,
+			label: 'On AMQP',
+			description: 'Triggered by an AMQP (RabbitMQ) message',
+			icon: Radio
+		},
+		{
+			id: 'nats',
+			configuredAfterCreate: true,
+			label: 'On NATS',
+			description: 'Triggered by a NATS message',
+			icon: MessageSquare
+		},
+		{
+			id: 'postgres',
+			configuredAfterCreate: true,
+			label: 'On Postgres',
+			description: 'Triggered by a Postgres event',
+			icon: Database
+		},
+		{
+			id: 'sqs',
+			configuredAfterCreate: true,
+			label: 'On SQS',
+			description: 'Triggered by an SQS message',
+			icon: Send
+		},
+		{
+			id: 'gcp',
+			configuredAfterCreate: true,
+			label: 'On GCP Pub/Sub',
+			description: 'Triggered by a Pub/Sub message',
+			icon: CloudCog
+		}
+	]}
+	languages={PIPELINE_LANGUAGES as any}
+	{pathPrefix}
+	{defaultPathSuffix}
+	onPick={handlePick}
+	{openSignal}
+	{trigger}
+/>
diff --git a/frontend/src/lib/components/assets/AssetGraph/AddDownstreamMenu.svelte b/frontend/src/lib/components/assets/AssetGraph/AddDownstreamMenu.svelte
new file mode 100644
index 0000000000..2a54fe11d4
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/AddDownstreamMenu.svelte
@@ -0,0 +1,73 @@
+<!--
+@component
+The menu adding a pipeline script downstream of an asset: opened from the asset's
+"+", or where that "+" was dropped on the blank canvas.
+-->
+<script lang="ts" module>
+	import type { ScriptLang } from '$lib/gen'
+	import type { AssetKind } from '$lib/components/assets/lib'
+	import type { PipelineInsertOptions } from './PipelineInsertMenu.svelte'
+	import type { PipelineOutputKind } from './pipelineTemplates'
+
+	export type AddScriptForAsset = (
+		asset: { kind: AssetKind; path: string },
+		language: ScriptLang,
+		scriptPath: string,
+		outputKind: PipelineOutputKind,
+		aiPrompt?: string,
+		options?: PipelineInsertOptions
+	) => void
+</script>
+
+<script lang="ts">
+	import { Code2 } from 'lucide-svelte'
+	import type { Snippet } from 'svelte'
+	import PipelineInsertMenu, { type PipelineInsertPick } from './PipelineInsertMenu.svelte'
+	import { PIPELINE_LANGUAGES } from './pipelineLanguages'
+
+	let {
+		asset,
+		onAddScript,
+		pathPrefix = '',
+		defaultPathSuffix = '',
+		openSignal,
+		trigger
+	}: {
+		asset: { kind: AssetKind; path: string }
+		onAddScript: AddScriptForAsset
+		pathPrefix?: string
+		defaultPathSuffix?: string
+		openSignal?: number
+		trigger: Snippet<[{ open: boolean }]>
+	} = $props()
+
+	function handlePick(pick: PipelineInsertPick) {
+		if (pick.kindId === 'pipeline_script' && pick.language && pick.path) {
+			onAddScript(
+				asset,
+				pick.language as ScriptLang,
+				pick.path,
+				(pick.outputKind ?? 'none') as PipelineOutputKind,
+				pick.aiPrompt,
+				{ outputAsset: pick.outputAsset }
+			)
+		}
+	}
+</script>
+
+<PipelineInsertMenu
+	kinds={[
+		{
+			id: 'pipeline_script',
+			label: 'Add downstream pipeline script',
+			description: 'Triggered when this asset changes',
+			icon: Code2
+		}
+	]}
+	languages={PIPELINE_LANGUAGES as any}
+	{pathPrefix}
+	{defaultPathSuffix}
+	{openSignal}
+	onPick={handlePick}
+	{trigger}
+/>
diff --git a/frontend/src/lib/components/assets/AssetGraph/AddDownstreamPill.svelte b/frontend/src/lib/components/assets/AssetGraph/AddDownstreamPill.svelte
new file mode 100644
index 0000000000..8ebd24455c
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/AddDownstreamPill.svelte
@@ -0,0 +1,23 @@
+<!--
+@component
+The "+" on an asset's bottom edge: a circle at rest, widened into a labelled pill
+while its menu is open or while it is being dragged. The label animates its
+max-width (width can't transition to auto) and never wraps.
+-->
+<script lang="ts">
+	import { Plus } from 'lucide-svelte'
+
+	let { expanded }: { expanded: boolean } = $props()
+</script>
+
+<span
+	class="group/add h-6 min-w-6 rounded-full flex items-center justify-center bg-surface border border-gray-400 dark:border-gray-600 text-secondary hover:text-primary hover:border-gray-500 shadow-sm leading-none overflow-hidden transition-[padding] duration-200 ease-out data-[open=true]:pl-1"
+	data-open={expanded}
+>
+	<Plus size={16} strokeWidth={2.5} class="shrink-0" />
+	<span
+		class="max-w-0 opacity-0 whitespace-nowrap text-3xs font-normal transition-[max-width,opacity,margin] duration-200 ease-out group-data-[open=true]/add:max-w-32 group-data-[open=true]/add:opacity-100 group-data-[open=true]/add:ml-1 group-data-[open=true]/add:mr-2"
+	>
+		Add downstream step
+	</span>
+</span>
diff --git a/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte b/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte
index 880abb685a..57a31e34d8 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte
@@ -1,145 +1,36 @@
 <script lang="ts">
-	import PipelineInsertMenu, { type PipelineInsertPick } from './PipelineInsertMenu.svelte'
-	import {
-		Plus,
-		Clock,
-		Webhook,
-		Mail,
-		Zap,
-		Radio,
-		MessageSquare,
-		Database,
-		Send,
-		CloudCog,
-		Upload
-	} from 'lucide-svelte'
-	import type { ScriptLang } from '$lib/gen'
-	import type { NativeTriggerKind } from './types'
-	import { PIPELINE_LANGUAGES } from './pipelineLanguages'
-	import type { PipelineOutputKind } from './pipelineTemplates'
-
-	// Each left-column kind is just "pipeline script triggered by <trigger
-	// source>". id === the SCRIPT_TRIGGER_KIND value, so the handler can
-	// dispatch on it uniformly. Asset-triggered scripts are not in this
-	// menu; those live under the per-asset + inside the graph.
-	type KindId = NativeTriggerKind
+	import AddDataSourceMenu from './AddDataSourceMenu.svelte'
+	import { Plus } from 'lucide-svelte'
+	import { NODE } from '$lib/components/graph/util'
 
 	interface Props {
-		data: {
-			onAddPipelineScript: (
-				language: ScriptLang,
-				path: string,
-				source: { kind: NativeTriggerKind; path: string | undefined },
-				outputKind: PipelineOutputKind,
-				aiPrompt?: string
-			) => void
-			pathPrefix: string
-			defaultPathSuffix: string
-		}
+		data: Pick<
+			import('svelte').ComponentProps<typeof AddDataSourceMenu>,
+			'onAddPipelineScript' | 'pathPrefix' | 'defaultPathSuffix'
+		>
 	}
 	let { data }: Props = $props()
-
-	function handlePick(pick: PipelineInsertPick) {
-		if (!pick.language || !pick.path) return
-		const kindId = pick.kindId as KindId
-		const outputKind = (pick.outputKind ?? 'none') as PipelineOutputKind
-		// Native trigger annotation is marker-only — the binding lives on
-		// the trigger row's own `script_path`, which the user creates
-		// separately. Seed with `path: undefined`.
-		data.onAddPipelineScript(
-			pick.language as ScriptLang,
-			pick.path,
-			{ kind: kindId, path: undefined },
-			outputKind,
-			pick.aiPrompt
-		)
-	}
 </script>
 
-<PipelineInsertMenu
-	kinds={[
-		{
-			id: 'data_upload',
-			label: 'On data upload',
-			description: 'UI-first: run by uploading a file via the S3 picker',
-			icon: Upload
-		},
-		{
-			id: 'schedule',
-			label: 'On schedule',
-			description: 'Triggered by a schedule you create',
-			icon: Clock
-		},
-		{
-			id: 'webhook',
-			label: 'On webhook',
-			description: 'Triggered by an HTTP webhook',
-			icon: Webhook
-		},
-		{
-			id: 'email',
-			label: 'On email',
-			description: 'Triggered by incoming email',
-			icon: Mail
-		},
-		{
-			id: 'kafka',
-			label: 'On Kafka',
-			description: 'Triggered by a Kafka message',
-			icon: Zap
-		},
-		{
-			id: 'mqtt',
-			label: 'On MQTT',
-			description: 'Triggered by an MQTT message',
-			icon: Radio
-		},
-		{
-			id: 'amqp',
-			label: 'On AMQP',
-			description: 'Triggered by an AMQP (RabbitMQ) message',
-			icon: Radio
-		},
-		{
-			id: 'nats',
-			label: 'On NATS',
-			description: 'Triggered by a NATS message',
-			icon: MessageSquare
-		},
-		{
-			id: 'postgres',
-			label: 'On Postgres',
-			description: 'Triggered by a Postgres event',
-			icon: Database
-		},
-		{
-			id: 'sqs',
-			label: 'On SQS',
-			description: 'Triggered by an SQS message',
-			icon: Send
-		},
-		{
-			id: 'gcp',
-			label: 'On GCP Pub/Sub',
-			description: 'Triggered by a Pub/Sub message',
-			icon: CloudCog
-		}
-	]}
-	languages={PIPELINE_LANGUAGES as any}
-	pathPrefix={data.pathPrefix}
-	defaultPathSuffix={data.defaultPathSuffix}
-	onPick={handlePick}
->
-	{#snippet trigger()}
-		<!-- Quiet insert affordance, mirroring the flow editor's inline +
-		     buttons (bg-surface + gray border + secondary text) — a filled
-		     accent circle outweighed every real node on the canvas. -->
-		<button
-			type="button"
-			class="w-8 h-8 rounded-full flex items-center justify-center bg-surface border border-gray-400 dark:border-gray-600 text-secondary shadow-sm hover:bg-surface-hover transition-colors cursor-pointer"
-			title="Add to pipeline"
-		>
-			<Plus size={16} />
-		</button>
-	{/snippet}
-</PipelineInsertMenu>
+<!-- The layout gives this node a full node-width slot; centering the pill in
+     it lines it up with the nodes below whatever its label's width. -->
+<div class="flex justify-center" style="width: {NODE.width}px;">
+	<AddDataSourceMenu
+		onAddPipelineScript={data.onAddPipelineScript}
+		pathPrefix={data.pathPrefix}
+		defaultPathSuffix={data.defaultPathSuffix}
+	>
+		{#snippet trigger()}
+			<!-- Quiet insert affordance, mirroring the flow editor's inline +
+			     buttons (bg-surface + gray border + secondary text) — a filled
+			     accent pill would outweigh every real node on the canvas. -->
+			<button
+				type="button"
+				class="h-8 px-3 rounded-full flex items-center gap-1.5 whitespace-nowrap bg-surface border border-gray-400 dark:border-gray-600 text-xs font-normal text-secondary shadow-sm hover:bg-surface-hover transition-colors cursor-pointer"
+			>
+				<Plus size={16} class="shrink-0" />
+				Add data source
+			</button>
+		{/snippet}
+	</AddDataSourceMenu>
+</div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
index 27f6ce6be7..87b085593c 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
@@ -1,8 +1,11 @@
 <script lang="ts">
 	import '@xyflow/svelte/dist/base.css'
+	import { randomUUID } from '$lib/utils/uuid'
+	import { onMount } from 'svelte'
 	import {
 		SvelteFlow,
 		Controls,
+		Panel,
 		MiniMap,
 		ConnectionLineType,
 		type Node,
@@ -13,13 +16,47 @@
 	import RunnableNode from './RunnableNode.svelte'
 	import TriggerNode, { type TriggerNodeKind } from './TriggerNode.svelte'
 	import AddNode from './AddNode.svelte'
+	import AddDataSourceMenu from './AddDataSourceMenu.svelte'
+	import PipelineInsertMenu, { type PipelineInsertSchedule } from './PipelineInsertMenu.svelte'
+	import AddDownstreamMenu from './AddDownstreamMenu.svelte'
+	import AddDownstreamPill from './AddDownstreamPill.svelte'
 	import DataTestNode from './DataTestNode.svelte'
 	import AssetGraphEdge from './AssetGraphEdge.svelte'
 	import PanToNode from './PanToNode.svelte'
 	import InitialFitView from './InitialFitView.svelte'
-	import { layoutAssetGraph } from './assetGraphLayout'
+	import {
+		layoutAssetGraph,
+		PIPELINE_NODE_EXTRA_ROW,
+		PIPELINE_NODE_HEADER,
+		PIPELINE_NODE_HEADER_CARD_PAD
+	} from './assetGraphLayout'
+	import {
+		assetsOnlyView,
+		upstreamDeletion,
+		withoutPassiveReads,
+		type AssetUpstream,
+		type AssetUpstreamDelete
+	} from './assetsOnlyView'
+	import { assetsOnlyNodeWidth } from './assetNodeWidth'
+	import { describeEdge } from './edgeDescription'
+	import { onDirectiveTargets } from './onDirectiveTargets'
+	import { listenChangeText, stopListeningChangeText } from './pipelineAnnotationEdits'
+	import { Button } from '$lib/components/common'
+	import type { NodeFix, NodeFixSpec } from './NodeFixButton.svelte'
+	import { isAssetsOnlyFolder, setAssetsOnlyFolder } from './assetsOnlyFolders'
+	import { formatAssetKind, formatShortAssetPath } from '$lib/components/assets/lib'
+	import { TRIGGER_NODE_STYLE } from './TriggerNode.svelte'
+	import { describeSchedule } from '$lib/utils/describeCron'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import { fly } from 'svelte/transition'
+	import { Clock, Plus } from 'lucide-svelte'
+	import {
+		getContextMenuContainerClass,
+		CONTEXT_MENU_ITEM_BASE_CLASS,
+		CONTEXT_MENU_ITEM_HOVER_CLASS
+	} from '$lib/components/common/contextmenu/contextMenuStyles'
 	import { computeMutedReadKeys, dbtAssociations } from './resolveGraph'
-	import { buildDownstreamMap } from './graphTraversal'
+	import { buildDownstreamMap, hoverLineage, transitivelyImpliedEdges } from './graphTraversal'
 	import { buildLineageDownstreamMap } from './boundedCascade'
 	import type {
 		AssetGraphResponse,
@@ -31,16 +68,15 @@
 	import type { AssetKind } from '$lib/gen'
 	import { NODE } from '$lib/components/graph/util'
 
-	// Width of the + node's rendered DOM element. Sugiyama allocates a full
-	// NODE.width slot for every node, so the small round button ends up
-	// left-aligned in its slot. We compensate by shifting the + node right
-	// by half the difference so its visual center matches the slot center.
-	const ADD_NODE_WIDTH = 40
-
 	interface Props {
 		graph: AssetGraphResponse
 		selection?: AssetGraphSelection | undefined
-		onselect?: (selection: AssetGraphSelection | undefined) => void
+		/** `open` marks a selection asked to be shown (a script's open button), as
+		 * opposed to a click on a node, which only selects it. */
+		onselect?: (
+			selection: AssetGraphSelection | undefined,
+			opts?: { open?: boolean }
+		) => void
 		// Called when the user clicks the per-asset + button (consumer-script
 		// entry). Kept optional so the canvas stays usable outside the
 		// pipeline editor.
@@ -49,7 +85,8 @@
 			language: import('$lib/gen').ScriptLang,
 			scriptPath: string,
 			outputKind: import('./pipelineTemplates').PipelineOutputKind,
-			aiPrompt?: string
+			aiPrompt?: string,
+			options?: import('./PipelineInsertMenu.svelte').PipelineInsertOptions
 		) => void
 		// Pipeline-wide + node shown at the top of the graph. Picking any
 		// kind from the menu invokes this one callback with the chosen
@@ -65,7 +102,8 @@
 				path: string | undefined
 			},
 			outputKind: import('./pipelineTemplates').PipelineOutputKind,
-			aiPrompt?: string
+			aiPrompt?: string,
+			options?: import('./PipelineInsertMenu.svelte').PipelineInsertOptions
 		) => void
 		// Folder-scoped prefix shown as a read-only chip in the insert menu
 		// path input (e.g. `f/{folder}/`). Shared across top + and per-asset +.
@@ -194,6 +232,32 @@
 		 * canvas is embedded inline inside a scrollable container, so a wheel
 		 * gesture over it scrolls the container instead of being captured. */
 		scrollZoom?: boolean
+		/** Offer the "Show scripts and triggers" switch; off folds scripts and triggers into the
+		 * assets they produce. */
+		assetsOnlyToggle?: boolean
+		/** The pipeline's `<workspace>/<folder>`, when the toggle's state should be
+		 * remembered for it. */
+		assetsOnlyFolder?: string
+		/** Deletes what produces an asset in the assets-only view: its script, and its
+		 * trigger when set. The canvas only offers what no other asset shares. */
+		onDeleteAssetUpstream?: (target: AssetUpstreamDelete) => void
+		/** Canvas node id → what is wrong with it and how to fix it (the Fix pill). */
+		nodeFixes?: ReadonlyMap<string, NodeFixSpec>
+		/** "Archive" for someone who can only archive the script the delete removes. */
+		assetDeleteVerb?: 'Delete' | 'Archive'
+		/** Makes scripts run after each write to an asset: a script's (or, in the
+		 * assets-only view, an asset's producers') top dot dragged onto that asset.
+		 * `reads` says whether each script already reads it. */
+		onAddAssetTrigger?: (a: {
+			scripts: Array<{ script: string; reads: boolean }>
+			asset: { kind: AssetKind; path: string }
+		}) => void
+		/** Makes scripts run after each write to an asset they read, or stop. `reads`
+		 * decides whether stopping also mutes the asset. */
+		onEdgeAction?: (a: {
+			action: 'listen' | 'stop'
+			targets: Array<{ script: string; asset: { kind: AssetKind; path: string }; reads: boolean }>
+		}) => void
 	}
 	let {
 		graph,
@@ -226,9 +290,347 @@
 		highlightActiveRun = false,
 		recomputedAssetIds,
 		assetRunStatus,
-		scrollZoom = true
+		scrollZoom = true,
+		assetsOnlyToggle = false,
+		assetsOnlyFolder,
+		onDeleteAssetUpstream,
+		nodeFixes,
+		assetDeleteVerb = 'Delete',
+		onEdgeAction,
+		onAddAssetTrigger
 	}: Props = $props()
 
+	// Two drags write `// on`: a script's top dot onto an asset, and an asset's "+"
+	// onto a script. Only the nodes the drop can subscribe without a loop stay lit.
+	// The "+" can also be dropped on the blank canvas, opening its add menu there.
+	let onDrag = $state<
+		| {
+				sourceId: string
+				from: { x: number; y: number }
+				to: { x: number; y: number }
+				eligible: Set<string>
+				over: string | undefined
+				/** Dragging an asset's "+", whose blank-canvas drop adds a step. */
+				feed: boolean
+				blank: boolean
+		  }
+		| undefined
+	>(undefined)
+	// Hit-tested on the boxes rather than with elementFromPoint: svelte-flow can
+	// make nodes click-through while the pointer is held down.
+	const within = (el: Element, x: number, y: number) => {
+		const r = el.getBoundingClientRect()
+		return x >= r.left && x <= r.right && y >= r.top && y <= r.bottom
+	}
+	let flowEl: HTMLElement | undefined = $state()
+	const nodeUnder = (x: number, y: number) =>
+		Array.from(flowEl?.querySelectorAll('.svelte-flow__node') ?? [])
+			.find((el) => within(el, x, y))
+			?.getAttribute('data-id') ?? undefined
+	const overBlank = (x: number, y: number) =>
+		!!flowEl &&
+		within(flowEl, x, y) &&
+		!Array.from(
+			flowEl.querySelectorAll('.svelte-flow__panel, .svelte-flow__controls, .svelte-flow__minimap')
+		).some((el) => within(el, x, y))
+	const readsAsset = (assetId: string, scriptId: string) =>
+		model.edges.some((x) => x.kind === 'lineage-read' && x.source === assetId && x.target === scriptId)
+	const assetOf = (assetId: string) => {
+		const a = model.nodes.find((n) => n.id === assetId)?.data
+		return a ? { kind: a.asset_kind as AssetKind, path: a.path as string } : undefined
+	}
+	function subscribe(assetId: string, scripts: string[]) {
+		const asset = assetOf(assetId)
+		if (!asset) return
+		onAddAssetTrigger?.({
+			asset,
+			scripts: scripts.map((id) => ({
+				script: id.replace(/^script:/, ''),
+				reads: readsAsset(assetId, id)
+			}))
+		})
+	}
+	/** `threshold`: pixels the pointer must travel before it counts as a drag, so a
+	 * plain click on the handle still clicks. */
+	function trackDrag(
+		e: PointerEvent,
+		start: { sourceId: string; feed: boolean; eligible: () => Set<string>; threshold: number },
+		drop: (target: string | undefined, at: { x: number; y: number }, blank: boolean) => void
+	) {
+		const from = { x: e.clientX, y: e.clientY }
+		let started = false
+		const begin = () => {
+			started = true
+			onDrag = {
+				sourceId: start.sourceId,
+				from,
+				to: from,
+				eligible: start.eligible(),
+				over: undefined,
+				feed: start.feed,
+				blank: false
+			}
+		}
+		if (start.threshold === 0) begin()
+		const move = (ev: PointerEvent) => {
+			if (!started) {
+				if (Math.hypot(ev.clientX - from.x, ev.clientY - from.y) < start.threshold) return
+				begin()
+			}
+			if (!onDrag) return
+			onDrag.to = { x: ev.clientX, y: ev.clientY }
+			onDrag.over = nodeUnder(ev.clientX, ev.clientY)
+			onDrag.blank = !onDrag.over && overBlank(ev.clientX, ev.clientY)
+		}
+		// A drag that ends without a release (pointer cancelled, window left) drops
+		// nothing, and must not leave its line following the cursor.
+		const teardown = () => {
+			window.removeEventListener('pointermove', move)
+			window.removeEventListener('pointerup', up)
+			window.removeEventListener('pointercancel', cancel)
+			window.removeEventListener('blur', cancel)
+			document.removeEventListener('visibilitychange', cancel)
+		}
+		const cancel = () => {
+			teardown()
+			onDrag = undefined
+		}
+		const up = (ev: PointerEvent) => {
+			teardown()
+			const drag = onDrag
+			onDrag = undefined
+			if (!started || !drag) return
+			// The release is not a click on whatever it lands on.
+			const swallow = (c: MouseEvent) => {
+				c.stopPropagation()
+				c.preventDefault()
+			}
+			window.addEventListener('click', swallow, { capture: true, once: true })
+			setTimeout(() => window.removeEventListener('click', swallow, { capture: true }), 0)
+			const target = nodeUnder(ev.clientX, ev.clientY)
+			const at = { x: ev.clientX, y: ev.clientY }
+			drop(target && drag.eligible.has(target) ? target : undefined, at, !target && drag.blank)
+		}
+		window.addEventListener('pointermove', move)
+		window.addEventListener('pointerup', up)
+		window.addEventListener('pointercancel', cancel)
+		window.addEventListener('blur', cancel)
+		document.addEventListener('visibilitychange', cancel)
+	}
+	function startOnDrag(sourceId: string, scripts: string[], e: PointerEvent) {
+		if (!onAddAssetTrigger || scripts.length === 0) return
+		trackDrag(
+			e,
+			{
+				sourceId,
+				feed: false,
+				threshold: 0,
+				eligible: () => {
+					const sets = scripts.map((id) => onDirectiveTargets(model.nodes, model.edges, id))
+					return new Set([...sets[0]].filter((a) => sets.every((t) => t.has(a))))
+				}
+			},
+			(target) => {
+				if (target) subscribe(target, scripts)
+			}
+		)
+	}
+	// Where a "+" dropped on the blank canvas opened its add menu.
+	let feedMenu = $state<
+		| { at: { x: number; y: number }; asset: { kind: AssetKind; path: string }; data: any }
+		| undefined
+	>(undefined)
+	let feedMenuSignal = $state(0)
+	function startFeedDrag(assetId: string, data: any, e: PointerEvent) {
+		trackDrag(
+			e,
+			{
+				sourceId: assetId,
+				feed: true,
+				threshold: 5,
+				// A drop target is a node whose scripts can all subscribe to the asset.
+				eligible: () => {
+					if (!onAddAssetTrigger) return new Set()
+					const targets = new Map<string, Set<string>>()
+					const can = (id: string) => {
+						if (!targets.has(id)) targets.set(id, onDirectiveTargets(model.nodes, model.edges, id))
+						return targets.get(id)!.has(assetId)
+					}
+					return new Set(
+						view.nodes
+							.filter((n) => {
+								const scripts = dragScripts(n)
+								return n.id !== assetId && scripts.length > 0 && scripts.every(can)
+							})
+							.map((n) => n.id)
+					)
+				}
+			},
+			(target, at, blank) => {
+				const node = target ? view.nodes.find((n) => n.id === target) : undefined
+				if (node) subscribe(assetId, dragScripts(node))
+				else if (blank) {
+					const asset = assetOf(assetId)
+					if (!asset) return
+					feedMenu = { at, asset, data }
+					feedMenuSignal++
+				}
+			}
+		)
+	}
+	// Pipeline scripts a node's top dot drags for: the script itself, or, in the
+	// assets-only view, the scripts building the asset.
+	function dragScripts(n: { id: string; type: string; data: any }): string[] {
+		const ids =
+			n.type === 'runnable' ? [n.id] : n.type === 'asset' ? ((n.data.foldedIds ?? []) as string[]) : []
+		return ids.filter((id) => {
+			const d = model.nodes.find((x) => x.id === id)?.data
+			return d?.runnable_kind === 'script' && d.in_pipeline
+		})
+	}
+
+	let assetsOnly = $state(false)
+	// Before the first paint: the default view is assets-only, and a plain effect
+	// would flash the full graph first.
+	$effect.pre(() => {
+		if (assetsOnlyFolder != undefined) assetsOnly = isAssetsOnlyFolder(assetsOnlyFolder)
+	})
+
+	// Right-click on the empty canvas: a menu at the pointer whose entry opens the
+	// add-data-source menu there too.
+	let paneMenu = $state<{ x: number; y: number } | undefined>(undefined)
+
+	// Hovering an edge names the relationship it draws, after a short pause so
+	// sweeping the pointer across the canvas doesn't flash popovers.
+	let hoveredEdge = $state<{ id: string; x: number; y: number } | undefined>(undefined)
+	let edgeHoverTimer: ReturnType<typeof setTimeout> | undefined
+	function onEdgeEnter({ edge, event }: { edge: Edge; event: PointerEvent }) {
+		clearTimeout(edgeHoverTimer)
+		const at = { id: edge.id, x: event.clientX, y: event.clientY }
+		edgeHoverTimer = setTimeout(() => (hoveredEdge = at), 300)
+	}
+	// Leaving the edge closes the popover after a moment, so the pointer can reach
+	// its buttons; entering the popover keeps it.
+	function onEdgeLeave() {
+		clearTimeout(edgeHoverTimer)
+		edgeHoverTimer = setTimeout(() => (hoveredEdge = undefined), 200)
+	}
+	// What the hovered edge lets you change: a plain read can become a trigger, and
+	// an asset trigger can be dropped. Both rewrite the script's `// on` header.
+	// What the hovered edge lets you change: a script that only reads the upstream
+	// asset can rerun on each write to it, and one it triggers can stop. On an
+	// assets-only edge, those are the scripts folded into it; both rewrite `// on`.
+	type EdgeTarget = { script: string; asset: { kind: AssetKind; path: string }; reads: boolean }
+	let hoveredEdgeActions = $derived.by(() => {
+		const e = hoveredEdge && onEdgeAction && view.edges.find((x) => x.id === hoveredEdge!.id)
+		if (!e) return []
+		const assetData = view.nodes.find((n) => n.id === e.source)?.data
+		if (!assetData?.asset_kind) return []
+		const asset = { kind: assetData.asset_kind as AssetKind, path: assetData.path as string }
+		const scriptIds =
+			e.kind === 'asset-flow'
+				? (e.via ?? [])
+				: e.kind === 'lineage-read' || e.kind === 'trigger-asset'
+					? [e.target]
+					: []
+		const listen: EdgeTarget[] = []
+		const stop: EdgeTarget[] = []
+		for (const id of scriptIds) {
+			const script = model.nodes.find((n) => n.id === id)?.data
+			if (script?.runnable_kind !== 'script' || !script.in_pipeline) continue
+			const has = (kind: string) =>
+				model.edges.some((x) => x.kind === kind && x.source === e.source && x.target === id)
+			const target = { script: script.path as string, asset, reads: has('lineage-read') }
+			if (has('trigger-asset')) stop.push(target)
+			// A script rerunning on its own writes would loop: offered only for inputs.
+			else if (
+				target.reads &&
+				!model.edges.some(
+					(x) => x.kind === 'lineage-write' && x.source === id && x.target === e.source
+				)
+			)
+				listen.push(target)
+		}
+		const where = (ts: EdgeTarget[]) =>
+			ts.length === 1 ? ts[0].script : `${ts.length} scripts: ${ts.map((t) => t.script).join(', ')}`
+		const out: Array<{ label: string; detail: string; run: () => void }> = []
+		if (listen.length) {
+			out.push({
+				label: 'Rerun on each write',
+				detail: `${listenChangeText(asset, true)} in ${where(listen)}; only the annotation header changes. Saved as a draft.`,
+				run: () => onEdgeAction?.({ action: 'listen', targets: listen })
+			})
+		}
+		if (stop.length) {
+			out.push({
+				label: 'Stop rerunning on writes',
+				detail: `${stopListeningChangeText(
+					asset,
+					stop.some((t) => t.reads)
+				)} in ${where(stop)}; only the annotation header changes. Saved as a draft.`,
+				run: () => onEdgeAction?.({ action: 'stop', targets: stop })
+			})
+		}
+		return out
+	})
+	let hoveredEdgeText = $derived.by(() => {
+		const e = hoveredEdge && view.edges.find((x) => x.id === hoveredEdge!.id)
+		if (!e) return undefined
+		const byId = new Map(view.nodes.map((n) => [n.id, n]))
+		const nameOf = (id: string) => {
+			const n = byId.get(id)
+			if (!n) return id.replace(/^[^:]+:/, '')
+			if (n.type === 'asset')
+				return formatShortAssetPath({ kind: n.data.asset_kind, path: n.data.path })
+			if (n.type === 'no-asset') return n.data.noAssetName
+			if (n.type === 'trigger') return n.data.summary || n.data.ref
+			return n.data.summary || n.data.path
+		}
+		return describeEdge(e, nameOf, (id) => byId.get(id)?.data)
+	})
+	let addMenuAt = $state<{ x: number; y: number }>({ x: 0, y: 0 })
+	let addMenuSignal = $state(0)
+
+	// The schedule wizard a Fix action opens for an existing script, at the pill.
+	let scheduleWizard = $state<
+		| {
+				script: string
+				onSchedule: (s: PipelineInsertSchedule) => void
+				at: { x: number; y: number }
+		  }
+		| undefined
+	>(undefined)
+	let scheduleWizardSignal = $state(0)
+
+	function toFix(spec: NodeFixSpec | undefined): NodeFix | undefined {
+		if (!spec) return undefined
+		return {
+			explainer: spec.explainer,
+			actions: spec.actions.map((a) => ({
+				label: a.label,
+				detail: a.detail,
+				run: (anchor) => {
+					if (a.scheduleFor) {
+						scheduleWizard = { ...a.scheduleFor, at: anchor }
+						scheduleWizardSignal++
+					} else a.run?.()
+				}
+			}))
+		}
+	}
+	function handleContextMenu(e: MouseEvent) {
+		const t = e.target as HTMLElement | null
+		// A node's own actions menu opens on right-click; the browser's never does,
+		// on nodes without one either.
+		if (t?.closest('.svelte-flow__node')) {
+			e.preventDefault()
+			return
+		}
+		if (!onAddPipelineScript || boundPick || !t?.closest('.svelte-flow__pane')) return
+		e.preventDefault()
+		paneMenu = { x: e.clientX, y: e.clientY }
+	}
+
 	// `${kind}:${path}` ids for the hovered / pinned runs (both script and flow
 	// variants, since the run row's kind isn't known here).
 	const runIds = (paths: string[] | undefined): Set<string> =>
@@ -256,7 +658,12 @@
 			| 'macro'
 			| 'test-dependency'
 			| 'dbt-ref'
+			// Assets-only view: an asset → an asset computed from it, through the
+			// script that is folded away.
+			| 'asset-flow'
 		unsaved?: boolean
+		// Assets-only `asset-flow`: a write to the source reruns a folded script.
+		reactive?: boolean
 		// Muted read edge: a ducklake/s3 input read every run whose (default)
 		// auto cascade trigger is suppressed by `// mute` / `// mute all`.
 		// Rendered with a bell-off badge — auto-wiring is the norm, so we mark
@@ -276,6 +683,8 @@
 		// whole lib when pulled in via `// use`) — rendered as a ƒ badge.
 		macro_names?: string[]
 		via_use?: boolean
+		// Assets-only edges: the scripts folded between the two assets.
+		via?: string[]
 	}
 
 	// Graph-id of the script the user just launched (zero-latency hint),
@@ -290,7 +699,7 @@
 	function build(g: AssetGraphResponse) {
 		const nodes: Array<{
 			id: string
-			type: 'asset' | 'runnable' | 'trigger' | 'add' | 'data-test'
+			type: 'asset' | 'runnable' | 'trigger' | 'add' | 'data-test' | 'no-asset'
 			data: any
 		}> = []
 		const edges: BuiltEdge[] = []
@@ -427,8 +836,10 @@
 					path: a.path,
 					fork_materialization: a.fork_materialization,
 					derived_from: a.derived_from,
+					error: a.error,
 					dbt: a.dbt,
 					onAddScript: onAddScriptForAsset,
+					neverWritten: a.never_written,
 					pathPrefix,
 					defaultPathSuffix,
 					producers: producersByAsset.get(`${a.kind}:${a.path}`) ?? [],
@@ -454,11 +865,14 @@
 									const owner = model.dbtOwnerByAsset.get(assetId)
 									const [kind, ...rest] = owner?.split(':') ?? []
 									if (kind && rest.length) {
-										onselect?.({
-											kind: 'runnable',
-											runnable_kind: kind as 'script' | 'flow',
-											path: rest.join(':')
-										})
+										onselect?.(
+											{
+												kind: 'runnable',
+												runnable_kind: kind as 'script' | 'flow',
+												path: rest.join(':')
+											},
+											{ open: true }
+										)
 									}
 								}
 							}
@@ -466,14 +880,6 @@
 				}
 			})
 		}
-		// Set of `script_path` values for runnables that are still drafts (no
-		// DB row yet). Trigger nodes use this to swap "Click to create" for
-		// "Click to create (after draft save)" so the user knows the create
-		// button is blocked until the script is deployed.
-		const unsavedRunnablePaths = new Set<string>()
-		for (const r of g.runnables) {
-			if (r.unsaved) unsavedRunnablePaths.add(r.path)
-		}
 		// Producer → its `// data_test` checks, keyed by runnable id, so the
 		// write-edge to the materialized asset can carry the test badge: the
 		// edge *is* the transformation, and the tests assert on what it produces.
@@ -526,6 +932,9 @@
 				data: {
 					runnable_kind: r.usage_kind,
 					path: r.path,
+					summary: r.summary,
+					language: r.language,
+					error: r.error,
 					in_pipeline: r.in_pipeline ?? false,
 					partition_kind: r.partition_kind,
 					freshness: r.freshness,
@@ -724,6 +1133,10 @@
 				kind: TriggerNodeKind
 				ref: string
 				missing: boolean
+				draft: boolean
+				schedule?: string
+				timezone?: string
+				summary?: string
 				// First target script (drives the per-script create/edit flows).
 				runnable_path?: string
 				// Every target script: a single (kind, ref) — e.g. one schedule —
@@ -739,7 +1152,11 @@
 			ref: string,
 			unsaved: boolean,
 			missing: boolean,
-			runnable_path?: string
+			draft: boolean,
+			runnable_path?: string,
+			schedule?: string,
+			timezone?: string,
+			summary?: string
 		) {
 			const prev = triggerSourceNodes.get(id)
 			if (!prev) {
@@ -748,6 +1165,10 @@
 					kind,
 					ref,
 					missing,
+					draft,
+					schedule,
+					timezone,
+					summary,
 					runnable_path,
 					runnable_paths: runnable_path ? [runnable_path] : []
 				})
@@ -796,13 +1217,17 @@
 				ref,
 				!!t.unsaved,
 				isMissing,
+				t.draft === true,
 				// Always thread the target script so the trigger node can
 				// reach back to it — drives both the missing-trigger "create"
 				// flow and the attached-trigger "edit" flow's script-path
 				// lock. Previously only set for missing, which silently
 				// disabled `canEdit` (and the resulting click affordance)
 				// on every attached native trigger.
-				t.runnable_path
+				t.runnable_path,
+				t.schedule,
+				t.timezone,
+				t.summary
 			)
 			edges.push({
 				id: `trig-${t.trigger_kind}:${sourceId}->${runnableId}`,
@@ -830,10 +1255,12 @@
 					ref: info.ref,
 					unsaved: info.allUnsaved,
 					missing: info.missing,
+					draft: info.draft,
+					schedule: info.schedule,
+					timezone: info.timezone,
+					summary: info.summary,
 					runnable_path: info.runnable_path,
-					runnable_unsaved: info.runnable_path
-						? unsavedRunnablePaths.has(info.runnable_path)
-						: false,
+					runnable_paths: info.runnable_paths,
 					// data_upload nodes go green once a file is staged for their
 					// target script (see readyDataUploadPaths / page dataUploadArgs).
 					ready: info.runnable_path
@@ -881,11 +1308,383 @@
 
 	let model = $derived(build(graph))
 
+	// The trigger chip last clicked in the assets-only view, by trigger node id: it
+	// opens a drawer rather than a selection, so it is highlighted until the next pick.
+	let activeTriggerId = $state<string | undefined>(undefined)
+	$effect(() => {
+		void selection
+		activeTriggerId = undefined
+	})
+
+	/** The chip naming what runs an asset's producer, and the editor it opens: the
+	 * same routes the trigger's own node takes. */
+	function triggerChip(
+		t: (AssetUpstream & { multiple: false })['trigger'],
+		scriptPath: string
+	): {
+		label: string
+		/** Nothing to show: the edges into the node already say it runs on writes. */
+		hidden?: boolean
+		kind?: string
+		nodeId?: string
+		missing?: boolean
+		draft?: boolean
+		onOpen?: () => void
+	} {
+		if (!t) return { label: 'Manual' }
+		if (t.kind === 'asset') return { label: '', hidden: true }
+		const kind = t.kind as NativeTriggerKind
+		const style = TRIGGER_NODE_STYLE[kind]
+		const label =
+			t.kind === 'schedule' && t.data?.schedule
+				? (describeSchedule(t.data.schedule, t.data.timezone) ?? `Schedule (${t.data.schedule})`)
+				: (style?.label ?? t.kind)
+		const rowless = kind === 'webhook' || kind === 'data_upload'
+		const missing = !!t.data?.missing && !rowless
+		const open =
+			kind === 'webhook'
+				? onOpenWebhook && (() => onOpenWebhook(scriptPath))
+				: kind === 'data_upload'
+					? onOpenDataUpload && (() => onOpenDataUpload(scriptPath))
+					: missing
+						? onCreateMissingTrigger && (() => onCreateMissingTrigger(kind, scriptPath))
+						: t.data?.ref && onEditTrigger
+							? () => onEditTrigger(kind, t.data.ref, scriptPath)
+							: undefined
+		return {
+			label,
+			kind,
+			nodeId: t.nodeId,
+			missing,
+			draft: t.data?.draft,
+			onOpen: open
+				? () => {
+						activeTriggerId = t.nodeId
+						open()
+					}
+				: undefined
+		}
+	}
+
+	// Scripts and triggers fold into the assets they produce: each asset carries
+	// its producer's run state, language and trigger instead of drawing them.
+	function assetsOnlyModel(m: typeof model): typeof model {
+		const v = assetsOnlyView(m.nodes, m.edges)
+		const runnables = new Map(m.nodes.filter((n) => n.type === 'runnable').map((n) => [n.id, n]))
+		// What an asset card shows in this view: its producer's chips, its width,
+		// and what deleting it removes. `data` is an asset's, or the "No asset" node's.
+		const fold = (data: any, u: AssetUpstream | undefined) => {
+			const r = u && !u.multiple ? runnables.get(u.runnableId)?.data : undefined
+			// A dbt model is built by its project, whose writes the canvas does not
+			// draw; its dbt chip already names it.
+			const upstream = !u
+				? data.dbt && data.dbt.resource_type !== 'source'
+					? undefined
+					: { none: true as const }
+				: u.multiple || !r
+					? {
+							multiple: true as const,
+							scripts: (u.multiple ? u.runnableIds : [])
+								.map((id) => runnables.get(id)?.data)
+								.filter((d) => d != undefined)
+								.map((d) => ({
+									runnableId: `${d.runnable_kind}:${d.path}`,
+									path: d.path as string,
+									summary: d.summary as string | undefined,
+									language: d.language,
+									unsaved: d.unsaved as boolean | undefined,
+									onOpen: () =>
+										onselect?.(
+											{ kind: 'runnable', runnable_kind: d.runnable_kind, path: d.path },
+											{ open: true }
+										)
+								})),
+							// Every script's own triggers; asset triggers show as edges instead.
+							triggers: (u.multiple ? u.runnableIds : [])
+								.flatMap((id) => {
+									const d = runnables.get(id)?.data
+									if (!d) return []
+									return m.edges
+										.filter((e) => e.kind === 'trigger-native' && e.target === id)
+										.map((e) => m.nodes.find((n) => n.id === e.source))
+										.filter((t) => t != undefined)
+										.map((t) => ({
+											...triggerChip(
+												{ nodeId: t.id, kind: t.data.kind, data: t.data },
+												d.path as string
+											),
+											script: d.path as string
+										}))
+								})
+								.filter((t) => !t.hidden)
+						}
+					: {
+							runnableId: u.runnableId,
+							path: r.path,
+							summary: r.summary,
+							language: r.language,
+							unsaved: r.unsaved,
+							runState: r.runState,
+							trigger: triggerChip(u.trigger, r.path),
+							onOpen: () =>
+								onselect?.(
+									{ kind: 'runnable', runnable_kind: r.runnable_kind, path: r.path },
+									{ open: true }
+								)
+						}
+			const toDelete =
+				onDeleteAssetUpstream && u && !u.multiple && r
+					? upstreamDeletion(u, r, v.upstream)
+					: undefined
+			// The scripts and triggers folded into this node, whose errors it reports.
+			const scriptIds = u ? (u.multiple ? u.runnableIds : [u.runnableId]) : []
+			const foldedIds = [
+				...scriptIds,
+				...m.edges
+					.filter((e) => e.kind === 'trigger-native' && scriptIds.includes(e.target))
+					.map((e) => e.source)
+			]
+			const foldedErrors = foldedIds.filter((id) => nodeFixes?.has(id)).length
+			const asset = { kind: data.asset_kind, path: data.path }
+			// Chips this estimate does not model keep the regular width.
+			const width =
+				upstream && !data.dbt && !data.fork_materialization && !data.derived_from && !data.runStatus
+					? assetsOnlyNodeWidth({
+							kind: data.noAsset ? 'No asset' : formatAssetKind(asset),
+							title: data.noAsset ? data.noAssetName : formatShortAssetPath(asset),
+							chip: foldedErrors
+								? `${foldedErrors} errors · Fix`
+								: 'none' in upstream
+									? 'External source'
+									: 'multiple' in upstream
+										? (upstream.triggers?.length ?? 0) > 1
+											? 'Multiple triggers'
+											: (upstream.triggers?.length ?? 0) === 1
+												? (upstream.triggers?.[0]?.label ?? '')
+												: ''
+										: upstream.trigger.hidden
+											? ''
+											: `${upstream.trigger.label}${upstream.trigger.draft ? ' · draft' : ''}`,
+							chipIcon: foldedErrors > 0,
+							// Room for the chip's trailing icon: a pencil, or the chevron of a
+							// several-trigger menu (about as wide).
+							chipEdit:
+								!foldedErrors &&
+								('multiple' in upstream
+									? (upstream.triggers?.length ?? 0) > 1 ||
+										(!!upstream.triggers?.[0]?.onOpen && !upstream.triggers?.[0]?.missing)
+									: 'trigger' in upstream &&
+										!!upstream.trigger?.onOpen &&
+										!upstream.trigger.missing),
+							header:
+								'runnableId' in upstream
+									? {
+											label: upstream.summary || upstream.path,
+											icons: 1,
+											draft: !!upstream.unsaved
+										}
+									: 'scripts' in upstream && upstream.scripts?.length
+										? upstream.scripts.length === 1
+											? {
+													label: upstream.scripts[0].summary || upstream.scripts[0].path,
+													icons: 1,
+													draft: !!upstream.scripts[0].unsaved
+												}
+											: { label: `${upstream.scripts.length} scripts`, icons: 2, chevron: true }
+										: undefined
+						})
+					: undefined
+			return {
+				...data,
+				upstream,
+				width,
+				foldedIds,
+				...(toDelete
+					? {
+							upstreamDelete: toDelete,
+							deleteVerb: assetDeleteVerb,
+							onDeleteUpstream: (t: AssetUpstreamDelete) => onDeleteAssetUpstream?.(t)
+						}
+					: onDeleteAssetUpstream && u
+						? {
+								// No combined delete, but each script it folds can still go on its
+								// own: in this view its node's menu is the only way to reach it.
+								scriptDeletes: (u.multiple ? u.runnableIds : [u.runnableId])
+									.map((id) => runnables.get(id)?.data)
+									.filter((d) => d?.runnable_kind === 'script')
+									.map((d) => ({ path: d.path as string, unsaved: !!d.unsaved })),
+								// Its scripts' own triggers: a row that starts only them, which
+								// webhooks and data uploads (no row) and missing ones are not.
+								triggerDeletes: scriptIds.flatMap((id) => {
+									const runnable = runnables.get(id)?.data
+									// A flow is not deleted from here, and neither are its triggers.
+									if (runnable?.runnable_kind !== 'script') return []
+									const scriptPath = runnable.path
+									return m.edges
+										.filter((e) => e.kind === 'trigger-native' && e.target === id)
+										.map((e) => m.nodes.find((n) => n.id === e.source)?.data)
+										.filter(
+											(t) =>
+												t &&
+												t.kind !== 'webhook' &&
+												t.kind !== 'data_upload' &&
+												t.ref &&
+												!t.missing &&
+												((t.runnable_paths ?? []) as string[]).every((p) => p === scriptPath)
+										)
+										.map((t) => ({
+											kind: t.kind as NativeTriggerKind,
+											path: t.ref as string,
+											draft: !!t.draft
+										}))
+								}),
+								deleteVerb: assetDeleteVerb,
+								onDeleteUpstream: (t: AssetUpstreamDelete) => onDeleteAssetUpstream?.(t),
+								// The No-asset card stands for its scripts; an asset is built by them.
+								deleteBlocked: data.noAsset
+									? !u.multiple
+										? 'it stands for a flow'
+										: u.runnableIds.length > 1
+											? 'it stands for several scripts'
+											: 'its script has several triggers'
+									: !u.multiple
+										? r?.runnable_kind === 'flow'
+											? 'a flow builds it'
+											: 'its script builds other assets too'
+										: u.runnableIds.length > 1
+											? 'several scripts build it'
+											: 'its script has several triggers'
+							}
+						: {})
+			}
+		}
+		const nodes = m.nodes
+			.filter((n) => n.id === ADD_NODE_ID || v.nodeIds.has(n.id))
+			.map((n) => (n.type === 'asset' ? { ...n, data: fold(n.data, v.upstream.get(n.id)) } : n))
+		for (const id of v.noAssetNodeIds) {
+			const u = v.upstream.get(id)
+			const scriptId = u && !u.multiple ? u.runnableId : u?.runnableIds[0]
+			const data = fold(
+				{ noAsset: true, noAssetName: scriptId?.split('/').pop() ?? 'script' },
+				u
+			)
+			// Run only by writes to what it reads, the edges into it already say how
+			// it starts: the script's banner alone. Another trigger, or an error to
+			// fix, needs the card's chip row.
+			const bannerOnly =
+				!!u &&
+				!u.multiple &&
+				u.trigger?.kind === 'asset' &&
+				!(data.foldedIds as string[]).some((f) => nodeFixes?.has(f))
+			nodes.push({ id, type: 'no-asset', data: bannerOnly ? { ...data, bannerOnly } : data })
+		}
+		const edges: BuiltEdge[] = v.edges.map((e) => ({ ...e, kind: e.kind as BuiltEdge['kind'] }))
+		if (nodes.some((n) => n.id === ADD_NODE_ID)) {
+			const hasIncoming = new Set(edges.map((e) => e.target))
+			for (const n of nodes) {
+				if (n.id !== ADD_NODE_ID && !hasIncoming.has(n.id)) {
+					edges.push({
+						id: `add-anchor:${n.id}`,
+						source: ADD_NODE_ID,
+						target: n.id,
+						kind: 'add-anchor'
+					})
+				}
+			}
+		}
+		return { ...m, nodes, edges }
+	}
+	// Reads that start nothing (lookups, reference tables) are often most of a
+	// graph's edges; hiding them leaves what makes the pipeline run. Remembered
+	// across pipelines.
+	const SHOW_PASSIVE_READS_KEY = 'pipeline-show-passive-reads'
+	let showPassiveReads = $state(true)
+	try {
+		showPassiveReads = localStorage.getItem(SHOW_PASSIVE_READS_KEY) !== 'false'
+	} catch {}
+	let withoutPassive = $derived(withoutPassiveReads(model.nodes, model.edges))
+	// Only where the toggle is shown: the preference is global, and a graph
+	// without the toggle would have no way to show the reads again.
+	let shownModel = $derived(
+		!assetsOnlyToggle || showPassiveReads || withoutPassive.dropped === 0
+			? model
+			: { ...model, nodes: withoutPassive.nodes, edges: withoutPassive.edges }
+	)
+	let view = $derived(assetsOnly ? assetsOnlyModel(shownModel) : shownModel)
+
 	// dbt association, surfaced by emphasis instead of edges. Hovering a model's
 	// dbt badge lights up the project node that materializes it; hovering the
 	// project node lights up every model it owns. Clicking the badge selects the
 	// project node, so the association survives the pointer leaving.
 	let dbtHoverId = $state<string | undefined>(undefined)
+
+	// Hovering a node keeps its lineage — everything upstream and downstream of
+	// it, recursively — at full strength and fades the rest. Off while a bounded
+	// pick or a subscribe drag owns the graph's dimming.
+	let hoveredNodeId = $state<string | undefined>(undefined)
+	// A click re-renders the graph under the cursor (the selection rebuilds the
+	// nodes, the details pane resizes or covers the canvas), which fires bursts of
+	// leave/enter. The fade waits for the pointer to settle on a node, outlives a
+	// brief leave, and stays off on a node just clicked until another is hovered.
+	let hoverTimer: ReturnType<typeof setTimeout> | undefined
+	let clickedNodeId: string | undefined
+	function onNodePointerEnter(id: string) {
+		clearTimeout(hoverTimer)
+		if (id === clickedNodeId) return
+		clickedNodeId = undefined
+		hoverTimer = setTimeout(() => (hoveredNodeId = id), 120)
+	}
+	function onNodePointerLeave() {
+		clearTimeout(hoverTimer)
+		hoverTimer = setTimeout(() => (hoveredNodeId = undefined), 80)
+	}
+	$effect(() => () => clearTimeout(hoverTimer))
+	let lineage = $derived(
+		hoveredNodeId && hoveredNodeId !== ADD_NODE_ID && !boundPick && !onDrag
+			? hoverLineage(
+					view.edges.filter((e) => e.kind !== 'add-anchor'),
+					hoveredNodeId
+				)
+			: undefined
+	)
+	// The fade goes through a stylesheet keyed on node and edge ids, never through
+	// the graph's node or edge objects: new node objects make the flow re-measure
+	// them and rebuild every edge they touch, and a rebuilt element jumps to its
+	// new opacity instead of easing there.
+	const canvasId = randomUUID()
+	let lineageFadeCss = $derived.by(() => {
+		if (!lineage) return ''
+		const scope = `[data-asset-canvas="${canvasId}"]`
+		const nodes = view.nodes
+			.filter((n) => outsideLineage(n.id))
+			.map((n) => `${scope} .svelte-flow__node[data-id="${CSS.escape(n.id)}"]`)
+		const edges = view.edges
+			.filter((e) => e.kind !== 'add-anchor' && !lineage!.hasEdge(e))
+			.map((e) => `${scope} .svelte-flow__edge[data-id="${CSS.escape(e.id)}"]`)
+		return [
+			nodes.length ? `${nodes.join(',')}{opacity:0.5}` : '',
+			edges.length ? `${edges.join(',')}{opacity:0.35}` : ''
+		].join('')
+	})
+	// Assets-only: a trigger edge A → C that A → B → … → C already implies says
+	// nothing new, so it recedes; the chain carries the cascade.
+	let impliedTriggerEdges = $derived(
+		assetsOnly
+			? transitivelyImpliedEdges(view.edges.filter((e) => e.kind === 'asset-flow' && e.reactive))
+			: new Set<string>()
+	)
+	let lineageSheet = $state<HTMLStyleElement | undefined>(undefined)
+	onMount(() => {
+		const sheet = document.createElement('style')
+		document.head.appendChild(sheet)
+		lineageSheet = sheet
+		return () => sheet.remove()
+	})
+	$effect(() => {
+		if (lineageSheet) lineageSheet.textContent = lineageFadeCss
+	})
+	const outsideLineage = (id: string) =>
+		!!lineage && id !== ADD_NODE_ID && !lineage.upstream.has(id) && !lineage.downstream.has(id)
 	let dbtEmphasisIds = $derived.by(() => {
 		if (!dbtHoverId) return new Set<string>()
 		const owned = model.dbtWritesByOwner.get(dbtHoverId)
@@ -922,14 +1721,14 @@
 	// input; the rendered edges are untouched (both arrows still drawn).
 	let writeEdgePairs = $derived(
 		new Set(
-			model.edges.filter((e) => e.kind === 'lineage-write').map((e) => `${e.source}\n${e.target}`)
+			view.edges.filter((e) => e.kind === 'lineage-write').map((e) => `${e.source}\n${e.target}`)
 		)
 	)
 	let layoutInput = $derived({
-		nodes: model.nodes
-			.map((n) => ({ id: n.id, data: n.data }))
+		nodes: view.nodes
+			.map((n) => ({ id: n.id, data: n.data, width: n.data?.width as number | undefined }))
 			.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0)),
-		edges: model.edges
+		edges: view.edges
 			.filter(
 				(e) =>
 					!(
@@ -950,7 +1749,18 @@
 						: 1
 			)
 	})
-	let layoutPositions = $derived(layoutAssetGraph(layoutInput, ADD_NODE_ID))
+	let layoutPositions = $derived(
+		layoutAssetGraph(
+			layoutInput,
+			ADD_NODE_ID,
+			assetsOnly
+				? PIPELINE_NODE_EXTRA_ROW + PIPELINE_NODE_HEADER + PIPELINE_NODE_HEADER_CARD_PAD
+				: 0
+		)
+	)
+
+	/** Assets-only asset cards size to their text; every other node is `NODE.width`. */
+	const nodeWidth = (n: { data?: any }): number => n.data?.width ?? NODE.width
 
 	let positionedNodes = $derived.by(() => {
 		// Compute bbox width from layout; shift every x so the graph is
@@ -965,11 +1775,8 @@
 		}
 		const bboxWidth = isFinite(minX) ? maxX - minX : 0
 		const xCenter = paneWidth / 2 - bboxWidth / 2
-		return model.nodes.map<Node>((n) => {
+		return view.nodes.map<Node>((n) => {
 			const p = layoutPositions.get(n.id) ?? { x: 0, y: 0 }
-			// Compensate for the + node being narrower than its layout slot
-			// so it visually centers over the node(s) below.
-			const xShift = n.id === ADD_NODE_ID ? (NODE.width - ADD_NODE_WIDTH) / 2 : 0
 			// Activity-panel emphasis (purely visual rings, kept off `selected`
 			// which swaps the details pane). Hover wins over pin so the cursor
 			// always tracks.
@@ -998,12 +1805,73 @@
 				else if (!boundPick.eligible.has(n.id)) boundClass = 'wm-bound-dim'
 			}
 			const dbtClass = dbtEmphasisIds.has(n.id) ? 'wm-dbt-linked' : undefined
+			const dragClass = !onDrag
+				? undefined
+				: onDrag.eligible.has(n.id)
+					? onDrag.over === n.id
+						? 'wm-drag-over'
+						: undefined
+					: n.id === onDrag.sourceId
+						? undefined
+						: 'wm-drag-dim'
+			// The chips' selected look rides on the positioned nodes, so a selection
+			// never re-runs the layout.
+			const up = n.type === 'asset' || n.type === 'no-asset' ? n.data.upstream : undefined
+			const fix = toFix(nodeFixes?.get(n.id))
+			const withUpstream = up?.scripts
+				? {
+						...n.data,
+						upstream: {
+							...up,
+							selected: up.scripts.some(
+								(sc: { runnableId: string }) => sc.runnableId === selectedId
+							),
+							triggers: (up.triggers ?? []).map((t: { nodeId?: string }) => ({
+								...t,
+								selected: !!t.nodeId && t.nodeId === activeTriggerId
+							}))
+						}
+					}
+				: up?.runnableId !== undefined
+					? {
+							...n.data,
+							upstream: {
+								...up,
+								selected: up.runnableId === selectedId,
+								trigger: {
+									...up.trigger,
+									selected: !!up.trigger.nodeId && up.trigger.nodeId === activeTriggerId
+								}
+							}
+						}
+					: n.data
+			const foldedFixes = ((n.data.foldedIds ?? []) as string[])
+				.map((id) => toFix(nodeFixes?.get(id)))
+				.filter((f) => f != undefined)
+			const scriptsToDrag = onAddAssetTrigger ? dragScripts(n) : []
+			// Assets-only: a folded script with an error reddens the header naming it.
+			const scriptError = ((n.data.foldedIds ?? []) as string[]).some(
+				(id) => id.startsWith('script:') && nodeFixes?.has(id)
+			)
+			const data = {
+				...withUpstream,
+				...(scriptError ? { scriptError } : {}),
+				...(fix ? { fix } : {}),
+				...(foldedFixes.length ? { foldedFixes } : {}),
+				...(scriptsToDrag.length
+					? { onStartOnDrag: (e: PointerEvent) => startOnDrag(n.id, scriptsToDrag, e) }
+					: {}),
+				...(n.type === 'asset' && onAddScriptForAsset
+					? { onStartFeedDrag: (e: PointerEvent) => startFeedDrag(n.id, n.data, e) }
+					: {})
+			}
 			return {
 				id: n.id,
 				type: n.type,
-				position: { x: p.x + xCenter + xShift, y: p.y + 40 },
-				data: n.data,
-				class: boundClass ?? dbtClass ?? runClass ?? assetClass,
+				// The layout places centers; a node's position is its top-left corner.
+				position: { x: p.x - nodeWidth(n) / 2 + xCenter, y: p.y + 40 },
+				data,
+				class: dragClass ?? boundClass ?? dbtClass ?? runClass ?? assetClass,
 				selected: n.id === selectedId,
 				// All nodes non-draggable: the layout is sugiyama-computed,
 				// dragging would fight the reactive re-layout. Selection is
@@ -1013,7 +1881,7 @@
 				// on its inner box so the edit/create button still receives
 				// clicks despite svelte-flow's wrapper-level pointer-events: none.
 				draggable: false,
-				selectable: n.id !== ADD_NODE_ID && n.type !== 'trigger'
+				selectable: n.id !== ADD_NODE_ID && n.type !== 'trigger' && n.type !== 'no-asset'
 			}
 		})
 	})
@@ -1039,7 +1907,7 @@
 	let assetEmphasis = $derived.by<Map<string, 'input' | 'output'>>(() => {
 		const m = new Map<string, 'input' | 'output'>()
 		if (emphasizedRunIdSet.size === 0) return m
-		for (const e of model.edges) {
+		for (const e of view.edges) {
 			if (e.kind === 'lineage-write' && emphasizedRunIdSet.has(e.source)) {
 				m.set(e.target, 'output')
 			} else if (
@@ -1058,15 +1926,20 @@
 	let nodeCenters = $derived(
 		positionedNodes
 			.filter((n) => n.id !== ADD_NODE_ID)
-			.map((n) => ({ id: n.id, cx: n.position.x + NODE.width / 2, cy: n.position.y }))
+			.map((n) => ({
+				id: n.id,
+				cx: n.position.x + nodeWidth(n) / 2,
+				cy: n.position.y,
+				halfW: nodeWidth(n) / 2
+			}))
 	)
-	// Detour lane for an edge whose straight run would pass over an unrelated
-	// node (the failure the same-column gutter can't see). For each node
-	// strictly between the endpoints' rows, sample the straight line at that
-	// row; if the node sits under it, route around the obstacle on the side the
-	// edge is already heading. Returns the outermost lane x clearing every
+	// Detour lane for an edge whose run would pass over an unrelated node. An
+	// edge spanning rows bends inside the first gap below its source and then
+	// runs straight down the *target's* column (see AssetGraphEdge), so every
+	// node strictly between the endpoints' rows is tested against the target's
+	// x, not against a source→target line. A crossed node is routed around on
+	// the side the target lies. Returns the outermost lane x clearing every
 	// crossed node, or undefined when the corridor is clear. O(nodes) per edge.
-	const HALF_W = NODE.width / 2
 	const ROUTE_PAD = NODE.gap.horizontal / 2
 	function detourForEdge(sourceId: string, targetId: string): number | undefined {
 		const s = nodeCenters.find((n) => n.id === sourceId)
@@ -1078,11 +1951,10 @@
 			if (n.id === sourceId || n.id === targetId) continue
 			// strictly between the two rows
 			if ((n.cy - s.cy) / dyTot <= 0.01 || (n.cy - s.cy) / dyTot >= 0.99) continue
-			const edgeX = s.cx + (t.cx - s.cx) * ((n.cy - s.cy) / dyTot)
-			if (Math.abs(edgeX - n.cx) >= HALF_W + 8) continue
+			if (Math.abs(t.cx - n.cx) >= n.halfW + 8) continue
 			// Crossed: a lane just outside this node, toward the target side.
 			const side = t.cx >= n.cx ? 1 : -1
-			const candidate = n.cx + side * (HALF_W + ROUTE_PAD)
+			const candidate = n.cx + side * (n.halfW + ROUTE_PAD)
 			// Keep the outermost lane so one detour clears every obstacle.
 			if (lane == undefined || Math.abs(candidate - s.cx) > Math.abs(lane - s.cx)) lane = candidate
 		}
@@ -1090,7 +1962,7 @@
 	}
 
 	let flowEdges = $derived.by(() =>
-		model.edges
+		view.edges
 			// Anchor edges are layout-only.
 			.filter((e) => e.kind !== 'add-anchor')
 			.map<Edge>((e) => {
@@ -1118,30 +1990,42 @@
 				// the "happening now" signal.
 				switch (e.kind) {
 					case 'lineage-write':
-						style = 'stroke: rgb(59 130 246); stroke-width: 2px;'
+						style = 'stroke: rgb(59 130 246); stroke-width: 1.25px;'
 						animated = flowAnimated
 						markerColor = 'rgb(59 130 246)'
 						break
+					case 'asset-flow':
+						// Assets-only: a write upstream reruns what builds the target
+						// (solid, like a trigger), or the target only reads it (dashed gray).
+						if (e.reactive) {
+							style = `stroke: rgb(59 130 246); stroke-width: 1.5px;${impliedTriggerEdges.has(e.id) ? ' opacity: 0.35;' : ''}`
+							markerColor = 'rgb(59 130 246)'
+						} else {
+							style = 'stroke: rgb(156 163 175); stroke-width: 1px;'
+							strokeDasharray = '4 3'
+							markerColor = 'rgb(156 163 175)'
+						}
+						break
 					case 'lineage-read':
-						style = 'stroke: rgb(156 163 175); stroke-width: 1.25px;'
+						style = 'stroke: rgb(156 163 175); stroke-width: 1px;'
 						animated = flowAnimated
 						break
 					case 'data-test':
 						// Asset → its custom-test script: dashed, muted, no run
 						// animation (the test isn't a producing step).
-						style = 'stroke: rgb(156 163 175); stroke-width: 1.25px;'
+						style = 'stroke: rgb(156 163 175); stroke-width: 1px;'
 						strokeDasharray = '4 3'
 						markerColor = 'rgb(156 163 175)'
 						break
 					case 'trigger-asset':
-						style = 'stroke: rgb(107 114 128); stroke-width: 2px;'
+						style = 'stroke: rgb(107 114 128); stroke-width: 1.25px;'
 						animated = flowAnimated
 						markerColor = 'rgb(107 114 128)'
 						label = 'triggers'
 						labelStyle = 'fill: rgb(107 114 128); font-size: 10px; font-weight: 600;'
 						break
 					case 'trigger-native':
-						style = 'stroke: rgb(107 114 128); stroke-width: 2px;'
+						style = 'stroke: rgb(107 114 128); stroke-width: 1.25px;'
 						strokeDasharray = '6 3'
 						markerColor = 'rgb(107 114 128)'
 						label = 'triggers'
@@ -1151,7 +2035,7 @@
 						// Library → consumer: violet dashed, visually apart from both
 						// lineage (blue/gray solid) and trigger (gray dashed) families —
 						// it's a code dependency, not data flow or execution.
-						style = 'stroke: rgb(139 92 246); stroke-width: 1.25px;'
+						style = 'stroke: rgb(139 92 246); stroke-width: 1px;'
 						strokeDasharray = '5 3'
 						markerColor = 'rgb(139 92 246)'
 						label = e.via_use ? 'uses lib' : 'macros'
@@ -1161,7 +2045,7 @@
 						// Producer → tested script: amber dashed ordering link. Not
 						// data flow (blue/gray) nor execution trigger (gray "triggers")
 						// — it only says "the test needs this asset to exist first".
-						style = 'stroke: rgb(217 119 6); stroke-width: 1.25px;'
+						style = 'stroke: rgb(217 119 6); stroke-width: 1px;'
 						strokeDasharray = '5 3'
 						markerColor = 'rgb(217 119 6)'
 						label = 'test needs'
@@ -1171,7 +2055,7 @@
 						// model → model inside one dbt project. Orange, matching the
 						// dbt badges, and dashed because the edge is dbt's own lineage
 						// rather than a Windmill read/write the cascade acts on.
-						style = 'stroke: rgb(234 88 12); stroke-width: 1.25px;'
+						style = 'stroke: rgb(234 88 12); stroke-width: 1px;'
 						strokeDasharray = '4 3'
 						markerColor = 'rgb(234 88 12)'
 						label = 'ref'
@@ -1208,7 +2092,7 @@
 				// (red dashed dimmed — fresh draft annotation that also has
 				// no matching row, which is the common case).
 				if (e.missing) {
-					style = 'stroke: rgb(239 68 68); stroke-width: 2px;'
+					style = 'stroke: rgb(239 68 68); stroke-width: 1.25px;'
 					strokeDasharray = '3 3'
 					markerColor = 'rgb(239 68 68)'
 					label = 'missing trigger'
@@ -1246,8 +2130,8 @@
 					style,
 					markerEnd: {
 						type: MarkerType.ArrowClosed,
-						width: 14,
-						height: 14,
+						width: 12,
+						height: 12,
 						color: markerColor
 					}
 				}
@@ -1265,6 +2149,7 @@
 
 	const nodeTypes = {
 		asset: AssetNode as any,
+		'no-asset': AssetNode as any,
 		runnable: RunnableNode as any,
 		trigger: TriggerNode as any,
 		add: AddNode as any,
@@ -1276,6 +2161,9 @@
 	}
 
 	function handleNodeClick({ node }: { node: Node }) {
+		clearTimeout(hoverTimer)
+		hoveredNodeId = undefined
+		clickedNodeId = node.id
 		// Bounded-run pick mode intercepts clicks: an eligible (downstream)
 		// node toggles as an end bound; the start, dimmed nodes, and
 		// triggers/+ are inert. Selection (details pane) is suppressed so the
@@ -1319,12 +2207,20 @@
 		) {
 			return
 		}
+		activeTriggerId = undefined
 		onselect(undefined)
 	}
 </script>
 
 <!-- svelte-ignore a11y_click_events_have_key_events, a11y_no_static_element_interactions -->
-<div class="w-full h-full relative" bind:clientWidth={paneWidth} onclickcapture={handleBackgroundClick}>
+<div
+	class="w-full h-full relative"
+	data-asset-canvas={canvasId}
+	bind:this={flowEl}
+	bind:clientWidth={paneWidth}
+	onclickcapture={handleBackgroundClick}
+	oncontextmenu={handleContextMenu}
+>
 	<SvelteFlow
 		{nodes}
 		{edges}
@@ -1342,12 +2238,42 @@
 		defaultEdgeOptions={{ type: 'asset' }}
 		proOptions={{ hideAttribution: true }}
 		onnodeclick={handleNodeClick}
+		onnodepointerenter={({ node }) => onNodePointerEnter(node.id)}
+		onnodepointerleave={onNodePointerLeave}
+		onedgepointerenter={onEdgeEnter}
+		onedgepointerleave={onEdgeLeave}
 		--background-color={false}
 	>
 		<div class="absolute inset-0 !bg-surface-secondary h-full"></div>
-		<InitialFitView {nodes} fitKey={viewportFitKey} />
+		<InitialFitView {nodes} fitKey={`${viewportFitKey}:${assetsOnly}`} />
 		<PanToNode targetId={panToNodeId} {nodes} />
 		<Controls position="top-right" orientation="horizontal" showLock={false} class="!mr-10" />
+		{#if assetsOnlyToggle}
+			<Panel position="top-left" class="!m-3 flex flex-col gap-1.5">
+				<Toggle
+					checked={!assetsOnly}
+					size="xs"
+					options={{ right: 'Show scripts and triggers' }}
+					on:change={(e) => {
+						assetsOnly = !e.detail
+						if (assetsOnlyFolder != undefined) setAssetsOnlyFolder(assetsOnlyFolder, assetsOnly)
+					}}
+				/>
+				{#if withoutPassive.dropped > 0}
+					<Toggle
+						checked={showPassiveReads}
+						size="xs"
+						options={{ right: "Show reads that don't trigger runs" }}
+						on:change={(e) => {
+							showPassiveReads = e.detail
+							try {
+								localStorage.setItem(SHOW_PASSIVE_READS_KEY, String(e.detail))
+							} catch {}
+						}}
+					/>
+				{/if}
+			</Panel>
+		{/if}
 		{#if showMinimap}
 			<!-- Node hues mirror the canvas: blue asset cards, amber triggers,
 			     bordered neutral script cards. Visible strokes + rounded corners +
@@ -1379,21 +2305,173 @@
 	</SvelteFlow>
 </div>
 
+<svelte:window
+	onpointerdown={(e) => {
+		if (paneMenu && !(e.target as HTMLElement | null)?.closest('[data-pane-menu]'))
+			paneMenu = undefined
+	}}
+	onkeydown={(e) => {
+		if (e.key === 'Escape') paneMenu = undefined
+	}}
+/>
+
+{#if paneMenu}
+	<div
+		class="fixed {getContextMenuContainerClass()}"
+		style="left: {paneMenu.x}px; top: {paneMenu.y}px;"
+		transition:fly={{ duration: 150, y: -10 }}
+		role="menu"
+		data-pane-menu
+	>
+		<button
+			type="button"
+			role="menuitem"
+			class="{CONTEXT_MENU_ITEM_BASE_CLASS} {CONTEXT_MENU_ITEM_HOVER_CLASS} gap-2 w-full text-left"
+			onclick={() => {
+				if (paneMenu) addMenuAt = paneMenu
+				paneMenu = undefined
+				addMenuSignal++
+			}}
+		>
+			<Plus size={14} />
+			Add data source
+		</button>
+	</div>
+{/if}
+
+{#if onDrag}
+	<svg class="fixed inset-0 w-screen h-screen pointer-events-none z-50" aria-hidden="true">
+		<line
+			x1={onDrag.from.x}
+			y1={onDrag.from.y}
+			x2={onDrag.to.x}
+			y2={onDrag.to.y}
+			class="stroke-blue-500"
+			stroke-width="1.5"
+			stroke-dasharray="4 3"
+		/>
+		{#if !(onDrag.feed && onDrag.blank)}
+			<circle cx={onDrag.to.x} cy={onDrag.to.y} r="3" class="fill-blue-500" />
+		{/if}
+	</svg>
+	{#if onDrag.feed && onDrag.blank}
+		<div
+			class="fixed z-50 pointer-events-none -translate-x-1/2 -translate-y-1/2"
+			style="left: {onDrag.to.x}px; top: {onDrag.to.y}px;"
+		>
+			<AddDownstreamPill expanded />
+		</div>
+	{/if}
+{/if}
+
+{#if feedMenu && onAddScriptForAsset}
+	<div
+		class="fixed z-10 -translate-x-1/2 -translate-y-1/2"
+		style="left: {feedMenu.at.x}px; top: {feedMenu.at.y}px;"
+	>
+		<AddDownstreamMenu
+			asset={feedMenu.asset}
+			onAddScript={onAddScriptForAsset}
+			pathPrefix={feedMenu.data.pathPrefix ?? pathPrefix}
+			defaultPathSuffix={feedMenu.data.defaultPathSuffix ?? defaultPathSuffix}
+			openSignal={feedMenuSignal}
+		>
+			{#snippet trigger({ open })}
+				{#if open}
+					<AddDownstreamPill expanded />
+				{/if}
+			{/snippet}
+		</AddDownstreamMenu>
+	</div>
+{/if}
+
+{#if hoveredEdge && hoveredEdgeText}
+	{@const d = hoveredEdgeText}
+	{@const actions = hoveredEdgeActions}
+	<!-- svelte-ignore a11y_no_static_element_interactions -->
+	<div
+		class="fixed z-50 max-w-80 rounded-md border bg-surface px-2.5 py-1.5 text-xs text-primary shadow-md"
+		style="left: {hoveredEdge.x + 12}px; top: {hoveredEdge.y + 12}px;"
+		transition:fly={{ duration: 120, y: -4 }}
+		role="tooltip"
+		onmouseenter={() => clearTimeout(edgeHoverTimer)}
+		onmouseleave={onEdgeLeave}
+	>
+		<span class="font-semibold text-emphasis">{d.subject}</span>
+		{d.phrase}
+		{#if d.object}<span class="font-semibold text-emphasis">{d.object}</span>{/if}
+		{#if d.note}<div class="mt-0.5 text-2xs text-secondary">{d.note}</div>{/if}
+		{#each actions as action (action.label)}
+			<div class="mt-2 flex flex-col gap-0.5">
+				<Button
+					variant="default"
+					unifiedSize="sm"
+					onclick={() => {
+						// Closing the popover drops `actions`: run what this one held.
+						const run = action.run
+						hoveredEdge = undefined
+						run()
+					}}
+				>
+					{action.label}
+				</Button>
+				<span class="text-2xs text-secondary">{action.detail}</span>
+			</div>
+		{/each}
+	</div>
+{/if}
+
+{#if scheduleWizard}
+	<div class="fixed w-0 h-0" style="left: {scheduleWizard.at.x}px; top: {scheduleWizard.at.y}px;">
+		<PipelineInsertMenu
+			kinds={[{ id: 'schedule', label: 'On schedule', description: '', icon: Clock }]}
+			onPick={() => {}}
+			openSignal={scheduleWizardSignal}
+			scheduleFor={scheduleWizard.script}
+			onSchedule={(s) => scheduleWizard?.onSchedule(s)}
+		>
+			{#snippet trigger()}
+				<span class="block w-0 h-0" aria-hidden="true"></span>
+			{/snippet}
+		</PipelineInsertMenu>
+	</div>
+{/if}
+
+{#if onAddPipelineScript}
+	<div class="fixed w-0 h-0" style="left: {addMenuAt.x}px; top: {addMenuAt.y}px;">
+		<AddDataSourceMenu
+			{onAddPipelineScript}
+			{pathPrefix}
+			{defaultPathSuffix}
+			openSignal={addMenuSignal}
+		>
+			{#snippet trigger()}
+				<span class="block w-0 h-0" aria-hidden="true"></span>
+			{/snippet}
+		</AddDataSourceMenu>
+	</div>
+{/if}
+
 <style lang="postcss">
 	:global(.svelte-flow__handle) {
 		opacity: 0;
 	}
+	/* Dragging a script's dot: what it cannot subscribe to recedes. */
+	:global(.svelte-flow__node.wm-drag-dim) {
+		opacity: 0.25;
+		transition: opacity 120ms;
+	}
+	:global(.svelte-flow__node.wm-drag-over .drop-shadow-sm) {
+		@apply ring-2 ring-blue-500 rounded-md;
+	}
 	:global(.svelte-flow__controls-button) {
 		@apply bg-surface border-0;
 	}
 	:global(.svelte-flow__controls-button:hover) {
 		@apply bg-surface-hover;
 	}
-	:global(.svelte-flow__node.selected .drop-shadow-sm) {
-		@apply outline outline-2 outline-blue-500;
-	}
 	/* Activity-panel emphasis — soft, monochromatic, less prominent than the
-	   blue details selection above. Hover is a thin neutral ring (transient);
+	   node's own selected state. Hover is a thin neutral ring (transient);
 	   pinning an expanded run is a soft-blue ring. */
 	/* A dbt project node and the models it materializes, related by badge
 	   rather than by edges — hovering either lights up the whole set. */
@@ -1427,6 +2505,11 @@
 	:global(.svelte-flow__node.wm-bound-end .drop-shadow-sm) {
 		@apply outline outline-[3px] outline-amber-500;
 	}
+	/* Hovering a node fades what is not in its lineage (see lineageFadeCss). */
+	:global(.svelte-flow__node),
+	:global(.svelte-flow__edge) {
+		transition: opacity 120ms;
+	}
 	:global(.svelte-flow__node.wm-bound-dim) {
 		@apply opacity-30;
 	}
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
index 6050c2d1cd..21965e7c2f 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
@@ -20,10 +20,17 @@
 		SquareFunction,
 		Trash2,
 		X,
-		Pencil
+		Pencil,
+		ChevronDown,
+		Zap
 	} from 'lucide-svelte'
-	import Popover from '$lib/components/meltComponents/Popover.svelte'
-	import { tick } from 'svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import {
+		upstreamScriptItems,
+		upstreamTriggerItems,
+		type UpstreamScript,
+		type UpstreamTriggerAction
+	} from './upstreamScriptItems'
 	import { inferArgs } from '$lib/infer'
 	import { emptySchema, sendUserToast } from '$lib/utils'
 	import type { Schema } from '$lib/common'
@@ -41,6 +48,7 @@
 	import { extractDraftMacros } from './resolveGraph'
 	import { assetColumnNodes, type ColumnLineageGraph } from './columnLineageGraph'
 	import SummaryPathDisplay from '$lib/components/SummaryPathDisplay.svelte'
+	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import S3FilePreview from '$lib/components/S3FilePreview.svelte'
 	import DataTablePreview from './DataTablePreview.svelte'
 	import DucklakeAssetPanel from './DucklakeAssetPanel.svelte'
@@ -117,7 +125,9 @@
 		// (`onDraftPersist`). `onDraftPersist` stays the authoritative commit on
 		// navigate-away; this is the continuous feed that keeps the draft's
 		// server copy current while the user is still typing.
-		onContentChange?: (scriptPath: string | undefined, content: string) => void
+		// `base`: the deployed copy being edited, so the parent can autosave unsaved
+		// edits to it before they are promoted to a draft. Unset for a draft.
+		onContentChange?: (scriptPath: string | undefined, content: string, base?: Script) => void
 		// Fires when the user navigates away from a draft (selects another
 		// node, closes the pane, etc.) — the parent must persist the new
 		// content + write outputs into its drafts Map. Without this,
@@ -133,7 +143,8 @@
 				writes: { kind: AssetWithAltAccessType['kind']; path: string }[]
 				// Body-inferred reads, so the parent's draft keeps its input
 				// lineage while inactive (no live inference runs for it).
-				reads: { kind: AssetWithAltAccessType['kind']; path: string }[]
+				// Undefined when nothing was inferred: keep what the draft has.
+				reads?: { kind: AssetWithAltAccessType['kind']; path: string }[]
 				// Full edited script — set when the source is a persisted
 				// script (needed to seed a brand-new draft entry).
 				script?: Script
@@ -156,6 +167,12 @@
 			path: string
 			unsaved?: boolean
 		}>
+		/** The selected asset's producing scripts, for its "Edit script" action,
+		 * which calls `onEditScript` with the one picked. */
+		producerScripts?: UpstreamScript[]
+		onEditScript?: (path: string) => void
+		/** The selected asset's upstream triggers that can be opened from here. */
+		producerTriggers?: UpstreamTriggerAction[]
 		// Pipeline-wide column-lineage graph (built by the parent page from the
 		// resolved graph). Drives the transitive column-lineage trace shown for a
 		// selected materialized asset.
@@ -215,15 +232,18 @@
 		// the edges. Counter rather than boolean so back-to-back runs
 		// re-fire the effect even if no other prop changed.
 		requestRunSignal?: number
-		// Folder-scoped non-editable prefix shown next to the suffix
-		// editor when the user renames a draft (e.g. `f/<folder>/`). The
-		// new path = pathPrefix + suffix.
-		pathPrefix?: string
 		// Called when the user renames a draft — the parent reseats the
 		// path key in its drafts map and updates activeDraftPath. Returns
 		// true on success; false on collision/validation failure so the
 		// popover can keep itself open and surface the error inline.
 		onDraftPathChange?: (oldPath: string, newPath: string) => boolean | string
+		onDraftMetaChange?: (
+			path: string,
+			meta: { summary: string; labels: string[] | undefined }
+		) => void
+		// The pipeline's folder prefix (`f/<folder>/`). A draft renamed outside it
+		// would be deployed out of the pipeline, so the rename is refused.
+		pathPrefix?: string
 		// Bumped by the parent (e.g. from the runnable-node action menu) to
 		// auto-open the archive/delete confirmation modal for the currently
 		// loaded persisted script. No-ops while the pane is showing a draft
@@ -280,6 +300,19 @@
 		// can persist a data-upload entry's staged input (drives node readiness).
 		// `isValid` is the full-schema validity, not just "file present".
 		onRunFormArgsChange?: (path: string, args: Record<string, any>, isValid: boolean) => void
+		// Show only the open script's inputs and runs (a data-upload click), not
+		// its editor. `onRunInputs` runs it with them, drafts included, and
+		// `onShowScript` leaves this view for the script.
+		inputsOnly?: boolean
+		/** `live` is the pane's buffer when it differs from what is stored: always
+		 * for a draft, and for a deployed script edited before switching to the
+		 * inputs view. A run with it previews that body. */
+		onRunInputs?: (
+			path: string,
+			args: Record<string, any>,
+			live?: { content: string; language: ScriptLang }
+		) => Promise<string | undefined>
+		onShowScript?: () => void
 	}
 	let {
 		selection,
@@ -301,6 +334,9 @@
 		onScriptRenamed,
 		onScriptRemoved,
 		selectionProducers = [],
+		producerScripts = [],
+		onEditScript,
+		producerTriggers = [],
 		selectionColumnGraph,
 		selectionColumnLoading = false,
 		selectionColumnTruncated = false,
@@ -315,8 +351,9 @@
 		activeRunnable,
 		onTestStateChange,
 		requestRunSignal,
-		pathPrefix = '',
 		onDraftPathChange,
+		onDraftMetaChange,
+		pathPrefix = '',
 		requestRemoveSignal,
 		downstreamSubscribers = 0,
 		onStartBoundedRun,
@@ -328,10 +365,15 @@
 		onRunByPath,
 		onRunCascadeByPath,
 		runFormInitialArgs,
-		onRunFormArgsChange
+		onRunFormArgsChange,
+		inputsOnly = false,
+		onRunInputs,
+		onShowScript
 	}: Props = $props()
 
 	let readOnly = $derived(mode !== 'edit')
+	// Someone who cannot switch the pipeline to edit mode only gets to read it.
+	let editScriptLabel = $derived(readOnly && !onRequestEdit ? 'Open script' : 'Edit script')
 
 	// Root element of the pane — used to scope the S3-input lookup for the
 	// data_upload focus effect.
@@ -408,7 +450,7 @@
 	// PipelineScriptView renders instead of the test panel.
 	let viewReadyForTarget = $derived.by(
 		() =>
-			readOnly &&
+			(readOnly || inputsOnly) &&
 			runTargetPath !== undefined &&
 			script?.path === runTargetPath &&
 			(isDraft || (!scriptRes.loading && scriptRes.current?.path === runTargetPath))
@@ -484,6 +526,12 @@
 	// alongside `liveBodyAssets` and forwarded so the live graph can show
 	// inferred column lineage on the edited script before it deploys.
 	let liveColumnLineage = $state<ColumnLineage[] | undefined>(undefined)
+	// The script whose editor last bound `liveBodyAssets` (undefined there means it
+	// inferred nothing). They stay bound after that editor unmounts, so a script
+	// that never had one (the inputs-only view) must not report or persist them as
+	// its lineage. Set by an effect declared after the save-on-switch one, whose
+	// cleanup still needs the previous owner when the selection moves.
+	let liveAssetsOwner: string | undefined = undefined
 
 	// Bumped when the runs panel reports a watched job has reached a
 	// terminal state. Drives S3FilePreview's refreshKey so the preview
@@ -549,7 +597,9 @@
 	let args = $state<Record<string, any>>({})
 	let argsSeedPath: string | undefined = undefined
 	$effect.pre(() => {
-		const p = script?.path
+		// Re-seeded on leaving the inputs-only view too, so the file picked there
+		// shows in the editor's test form.
+		const p = script?.path === undefined ? undefined : `${script.path}|${inputsOnly}`
 		if (p === argsSeedPath) return
 		argsSeedPath = p
 		args = runFormInitialArgs ? structuredClone($state.snapshot(runFormInitialArgs)) : {}
@@ -559,7 +609,8 @@
 	// required field (not just the S3 file) is satisfied.
 	let runFormIsValid = $state(true)
 	$effect(() => {
-		if (readOnly || !script) return
+		// Inputs-only mounts no ScriptEditor: PipelineScriptView reports its own args.
+		if (readOnly || inputsOnly || !script) return
 		onRunFormArgsChange?.(script.path, $state.snapshot(args), runFormIsValid)
 	})
 
@@ -596,18 +647,25 @@
 			b: Array<{ kind: string; path: string }>
 		) => a.length === b.length && a.every((x, i) => x.kind === b[i]?.kind && x.path === b[i]?.path)
 		return () => {
-			const writes = (liveBodyAssets ?? [])
+			// No editor inferred this script (the inputs-only view): keep its stored
+			// lineage rather than persisting it as empty.
+			const inferred = liveAssetsOwner === captured.path
+			const writes = !inferred
+				? (writesAtRegister ?? [])
+				: (liveBodyAssets ?? [])
 				.filter((a) => {
 					const t = a.access_type ?? a.alt_access_type
 					return t === 'w' || t === 'rw'
 				})
 				.map((a) => ({ kind: a.kind, path: a.path }))
-			const reads = (liveBodyAssets ?? [])
-				.filter((a) => {
-					const t = a.access_type ?? a.alt_access_type
-					return t === 'r' || t === 'rw'
-				})
-				.map((a) => ({ kind: a.kind, path: a.path }))
+			const reads = !inferred
+				? readsAtRegister
+				: (liveBodyAssets ?? [])
+						.filter((a) => {
+							const t = a.access_type ?? a.alt_access_type
+							return t === 'r' || t === 'rw'
+						})
+						.map((a) => ({ kind: a.kind, path: a.path }))
 			// Draft runs: emit only when content or lineage changed in THIS clone.
 			// An unconditional emit ping-pongs forever when the entry is rewritten
 			// externally while the pane stays mounted (rename rekey, AI edit):
@@ -617,6 +675,7 @@
 				(captured.content ?? '') === contentAtRegister &&
 				refsEq(writesAtRegister ?? [], writes) &&
 				readsAtRegister != undefined &&
+				reads != undefined &&
 				refsEq(readsAtRegister, reads)
 			)
 				return
@@ -651,12 +710,42 @@
 		}
 	})
 
+	$effect(() => {
+		if (script && !readOnly && !inputsOnly) liveAssetsOwner = script.path
+	})
+
 	let saving = $state(false)
 	// What this pane last deployed, so the persist-back cleanup can tell "the
 	// buffer equals the new deployed head" from real unsaved edits (plain
 	// variable: only read inside the untracked cleanup).
 	let deployedFromPane: { path: string; content: string } | undefined = undefined
 	let isDraft = $derived(draftScript != undefined)
+	function liveBody(): { content: string; language: ScriptLang } | undefined {
+		if (!script) return undefined
+		const live = { content: script.content ?? '', language: script.language as ScriptLang }
+		if (isDraft) return live
+		const orig = scriptRes.current
+		return orig?.path === script.path && (orig.content ?? '') !== live.content ? live : undefined
+	}
+	// A draft's stored schema is empty until an editor infers it, and the inputs
+	// view mounts none: infer from the body here so its fields (the file picker)
+	// show up.
+	const inputsSchema = resource(
+		[() => (inputsOnly && isDraft ? script?.content : undefined), () => script?.language],
+		async ([content, language]) => {
+			if (content === undefined || !language) return undefined
+			const schema = emptySchema()
+			try {
+				await inferArgs(language, content, schema as Schema)
+			} catch {
+				return undefined
+			}
+			return schema
+		}
+	)
+	let inputsScript = $derived(
+		script && inputsSchema.current ? { ...script, schema: inputsSchema.current } : undefined
+	)
 
 	// Single trash-bin button opens one modal that exposes both Archive
 	// (always available) and Delete permanently (admin-only). Archive is
@@ -763,12 +852,17 @@
 		onAnnotationsChange?.(script?.path, liveAnnotations)
 	})
 	$effect(() => {
-		if (readOnly) return
+		if (readOnly || (inputsOnly && liveAssetsOwner !== script?.path)) return
 		onAssetsChange?.(script?.path, liveBodyAssets ?? [], liveColumnLineage)
 	})
 	$effect(() => {
 		if (readOnly) return
-		onContentChange?.(script?.path, script?.content ?? '')
+		const base = draftScript ? undefined : scriptRes.current
+		onContentChange?.(
+			script?.path,
+			script?.content ?? '',
+			base && base.path === script?.path ? base : undefined
+		)
 	})
 
 	async function save() {
@@ -910,49 +1004,6 @@
 			JSON.stringify(script.schema ?? null) === JSON.stringify(orig.schema ?? null)
 		)
 	})
-
-	// Suffix editor for the draft-path popover. Seeded from the current
-	// path each time the popover opens so the user starts with what they
-	// see, not stale state from an earlier rename.
-	let draftPathSuffix = $state('')
-	let draftPathError = $state<string | undefined>(undefined)
-	let draftPathInput: HTMLInputElement | undefined = $state(undefined)
-
-	function suffixOf(fullPath: string): string {
-		return fullPath.startsWith(pathPrefix) ? fullPath.slice(pathPrefix.length) : fullPath
-	}
-
-	async function openDraftPathEditor() {
-		draftPathSuffix = script ? suffixOf(script.path) : ''
-		draftPathError = undefined
-		await tick()
-		draftPathInput?.focus()
-		draftPathInput?.select()
-	}
-
-	function confirmDraftPath(close: () => void) {
-		if (!script) return
-		const suffix = draftPathSuffix.trim()
-		if (!suffix) {
-			draftPathError = 'Path cannot be empty'
-			return
-		}
-		const newPath = pathPrefix + suffix
-		if (newPath === script.path) {
-			close()
-			return
-		}
-		const result = onDraftPathChange?.(script.path, newPath)
-		if (result === true || result === undefined) {
-			script.path = newPath
-			draftPathError = undefined
-			close()
-		} else if (typeof result === 'string') {
-			draftPathError = result
-		} else {
-			draftPathError = 'Path already in use'
-		}
-	}
 </script>
 
 <div class="flex flex-col h-full bg-surface" bind:this={paneEl}>
@@ -964,80 +1015,34 @@
 				{@const draftScriptPath = script.path}
 				<Code2 size={16} class="shrink-0 text-tertiary" />
 				{#if onDraftPathChange && !readOnly}
-					<!-- Inline rename popover for drafts. The persisted-script
-					     branch uses SummaryPathDisplay which round-trips through
-					     updateItemPathAndSummary; drafts have no server row yet,
-					     so we just rekey the parent's drafts map locally. -->
-					<Popover
-						placement="bottom-start"
-						contentClasses="p-3"
-						usePointerDownOutside
-						on:openChange={(e) => {
-							if (e.detail) openDraftPathEditor()
+					<!-- Same summary/path popover as a deployed script, saved into the
+					     drafts map instead of through the API: a draft has no row yet. -->
+					<SummaryPathDisplay
+						summary={script.summary ?? ''}
+						path={draftScriptPath}
+						labels={script.labels ?? []}
+						kind="script"
+						onSaved={() => {}}
+						saveOverride={({ path, summary, labels }) => {
+							if (pathPrefix && (!path.startsWith(pathPrefix) || path === pathPrefix)) {
+								return `A pipeline script stays in ${pathPrefix}: pick a name inside that folder`
+							}
+							// Before the rename, which carries the draft entry over as it is.
+							onDraftMetaChange?.(draftScriptPath, { summary, labels })
+							if (script) {
+								script.summary = summary
+								script.labels = labels
+							}
+							if (path === draftScriptPath) return undefined
+							const result = onDraftPathChange(draftScriptPath, path)
+							if (result !== true && result !== undefined) {
+								return typeof result === 'string' ? result : 'Path already in use'
+							}
+							if (script) script.path = path
+							return undefined
 						}}
-					>
-						{#snippet trigger()}
-							<button
-								type="button"
-								class="flex flex-col min-w-0 text-left px-2 py-1 rounded-md hover:bg-surface-hover transition-colors group"
-								title="Edit draft path"
-							>
-								<span
-									class="text-3xs uppercase tracking-wide text-tertiary flex items-center gap-1"
-								>
-									Draft pipeline script
-									<Pencil size={9} class="opacity-0 group-hover:opacity-60 transition-opacity" />
-								</span>
-								<span class="text-xs font-mono truncate" title={draftScriptPath}
-									>{draftScriptPath}</span
-								>
-							</button>
-						{/snippet}
-						{#snippet content({ close })}
-							<div class="flex flex-col gap-2 w-[420px]">
-								<span class="text-2xs font-normal text-secondary">Path</span>
-								<div
-									class="flex items-stretch border rounded-md bg-surface overflow-hidden focus-within:ring-2 focus-within:ring-blue-400"
-								>
-									{#if pathPrefix}
-										<span
-											class="flex items-center px-2 bg-surface-secondary text-tertiary text-sm font-mono border-r select-none"
-										>
-											{pathPrefix}
-										</span>
-									{/if}
-									<input
-										bind:this={draftPathInput}
-										bind:value={draftPathSuffix}
-										onkeydown={(e) => {
-											if (e.key === 'Enter') {
-												e.preventDefault()
-												confirmDraftPath(close)
-											} else if (e.key === 'Escape') {
-												e.preventDefault()
-												close()
-											}
-										}}
-										class="flex-1 min-w-0 px-2 py-1.5 text-sm font-mono bg-transparent focus:outline-none"
-										placeholder="my_script"
-									/>
-								</div>
-								{#if draftPathError}
-									<span class="text-2xs text-red-500">{draftPathError}</span>
-								{/if}
-								<div class="flex justify-end">
-									<Button
-										variant="accent"
-										unifiedSize="sm"
-										disabled={!draftPathSuffix.trim()}
-										onClick={() => confirmDraftPath(close)}
-									>
-										Rename
-									</Button>
-								</div>
-							</div>
-						{/snippet}
-					</Popover>
+					/>
+					<Badge color="gray">Draft</Badge>
 				{:else}
 					<div class="flex flex-col min-w-0">
 						<span class="text-3xs uppercase tracking-wide text-tertiary">
@@ -1097,6 +1102,66 @@
 			{/if}
 		</div>
 		<div class="flex items-center gap-1 shrink-0">
+			{#if selection?.kind === 'asset' && onEditScript && producerScripts.length === 1}
+				<Button
+					variant="default"
+					unifiedSize="sm"
+					startIcon={{ icon: Pencil }}
+					onclick={() => onEditScript(producerScripts[0].path)}
+					title={`Open ${producerScripts[0].path}, which builds this asset`}
+				>
+					{editScriptLabel}
+				</Button>
+			{:else if selection?.kind === 'asset' && onEditScript && producerScripts.length > 1}
+				<DropdownV2
+					items={upstreamScriptItems(producerScripts, onEditScript)}
+					placement="bottom-end"
+					enableFlyTransition
+				>
+					{#snippet buttonReplacement()}
+						<Button
+							nonCaptureEvent
+							variant="default"
+							unifiedSize="sm"
+							startIcon={{ icon: Pencil }}
+							endIcon={{ icon: ChevronDown }}
+							title={`${producerScripts.length} scripts build this asset`}
+						>
+							{editScriptLabel}
+						</Button>
+					{/snippet}
+				</DropdownV2>
+			{/if}
+			{#if selection?.kind === 'asset' && producerTriggers.length === 1}
+				<Button
+					variant="default"
+					unifiedSize="sm"
+					startIcon={{ icon: Zap }}
+					onclick={() => producerTriggers[0].onOpen()}
+					title={producerTriggers[0].detail}
+				>
+					{producerTriggers[0].label}
+				</Button>
+			{:else if selection?.kind === 'asset' && producerTriggers.length > 1}
+				<DropdownV2
+					items={upstreamTriggerItems(producerTriggers)}
+					placement="bottom-end"
+					enableFlyTransition
+				>
+					{#snippet buttonReplacement()}
+						<Button
+							nonCaptureEvent
+							variant="default"
+							unifiedSize="sm"
+							startIcon={{ icon: Zap }}
+							endIcon={{ icon: ChevronDown }}
+							title={`${producerTriggers.length} triggers start the scripts that build this asset`}
+						>
+							Triggers
+						</Button>
+					{/snippet}
+				</DropdownV2>
+			{/if}
 			{#if readOnly && onRequestEdit}
 				<Button
 					variant="accent"
@@ -1118,21 +1183,10 @@
 					title="Discard draft"
 				/>
 			{/if}
-			<!-- Action order, left → right: trash, external link, save, close.
-			     Save sits closest to Close so the primary commit action is
-			     anchored at the right edge of the bar; trash lives at the
-			     far left so destructive ops are visually separated from
-			     navigation/commit. Mirrors the draft Discard placement. -->
-			{#if !readOnly && !isDraft && isScriptView && script?.hash}
-				<Button
-					variant="subtle"
-					unifiedSize="sm"
-					startIcon={{ icon: Trash2 }}
-					onclick={() => (removeOpen = true)}
-					iconOnly
-					title="Archive or delete"
-				/>
-			{/if}
+			<!-- Action order, left → right: external link, save, close. Save sits
+			     closest to Close so the primary commit action is anchored at the
+			     right edge of the bar. Removing a script goes through its node's
+			     menu. -->
 			{#if !readOnly && !isDraft && selection?.kind === 'runnable'}
 				<Button
 					variant="subtle"
@@ -1338,14 +1392,31 @@
 				{/if}
 			</div>
 		{:else if !isDraft && scriptRes.loading && !script}
-			<div class="absolute inset-0 flex items-center justify-center gap-2 text-tertiary">
-				<Loader2 size={16} class="animate-spin" />
-				<span class="text-xs">Loading script…</span>
-			</div>
+			<!-- Blank while the script loads: the fetch is short, and a spinner only flashes. -->
 		{:else if !isDraft && scriptRes.error}
 			<div class="p-3 text-xs text-red-500">
 				Failed to load: {scriptRes.error.message}
 			</div>
+		{:else if script && inputsOnly}
+			{#key script.path}
+				<PipelineScriptView
+					{isDraft}
+					canRun
+					runsDrafts
+					inputsOnly
+					{onShowScript}
+					onRun={onRunInputs && ((path, args) => onRunInputs(path, args, liveBody()))}
+					script={inputsScript ?? script}
+					{runsRefreshKey}
+					{runsPendingJobId}
+					initialArgs={runFormInitialArgs}
+					onArgsChange={onRunFormArgsChange}
+					onRunCompleted={() => {
+						previewRefreshKey += 1
+						onRunCompleted?.()
+					}}
+				/>
+			{/key}
 		{:else if script && readOnly}
 			<!-- Read-only modes: no Monaco/ScriptEditor (operators are
 			     backend-blocked from previews anyway) — highlighted source,
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphEdge.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphEdge.svelte
index f39c2d8d18..a6d38b05d8 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphEdge.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphEdge.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { BaseEdge, getBezierPath, type EdgeProps } from '@xyflow/svelte'
 	import { NODE } from '$lib/components/graph/util'
+	import { PIPELINE_NODE_HEIGHT } from './assetGraphLayout'
 	import { FlaskConical, Columns3, SquareFunction, BellOff } from 'lucide-svelte'
 	import type { ColumnLineage, DataTest } from './parsePipelineAnnotations'
 
@@ -103,33 +104,42 @@
 	// straight under the nodes in between — the child-and-grandchild-of-the-
 	// same-node case, where the tidy-tree layout puts all three on one
 	// column. Detour those through the gutter beside the column.
-	const SKIP_DY = NODE.gap.vertical * 2 + NODE.height
+	const SKIP_DY = NODE.gap.vertical * 2 + PIPELINE_NODE_HEIGHT
 	const NEAR_VERTICAL_DX = NODE.width / 4
 	// Lane offset: half a node plus a margin that stays inside the
 	// inter-column gutter (gap.horizontal / 2).
 	const LANE = NODE.width / 2 + NODE.gap.horizontal / 2
-	const CORNER = 14
 
-	// Rounded-orthogonal detour: drop out of the source, swing into the
-	// gutter lane at `midX`, run it down past the intermediate rows, swing
-	// back into the target.
+	// Detour through the gutter lane at `midX`, drawn with the same curves as
+	// every other edge: curve out of the source into the lane within the gap
+	// below it, run down the lane past the rows in between, curve into the
+	// target within the gap above it.
 	function gutterPath(midX: number): string {
-		const yTop = sourceY + 24
-		const yBot = targetY - 24
-		const outDir = midX > sourceX ? 1 : -1
-		const inDir = targetX > midX ? 1 : -1
-		return [
-			`M ${sourceX} ${sourceY}`,
-			`L ${sourceX} ${yTop - CORNER}`,
-			`Q ${sourceX} ${yTop} ${sourceX + outDir * CORNER} ${yTop}`,
-			`L ${midX - outDir * CORNER} ${yTop}`,
-			`Q ${midX} ${yTop} ${midX} ${yTop + CORNER}`,
-			`L ${midX} ${yBot - CORNER}`,
-			`Q ${midX} ${yBot} ${midX + inDir * CORNER} ${yBot}`,
-			`L ${targetX - inDir * CORNER} ${yBot}`,
-			`Q ${targetX} ${yBot} ${targetX} ${yBot + CORNER}`,
-			`L ${targetX} ${targetY}`
-		].join(' ')
+		const bend = NODE.gap.vertical
+		const yTop = sourceY + bend
+		// Clamp only downward edges: an upward (feedback) edge must still run up the
+		// lane, or its last curve cuts across the node the detour was clearing.
+		const yBot = targetY > sourceY ? Math.max(yTop, targetY - bend) : targetY - bend
+		const [out] = getBezierPath({
+			sourceX,
+			sourceY,
+			sourcePosition,
+			targetX: midX,
+			targetY: yTop,
+			targetPosition,
+			curvature: 0.25
+		})
+		const [into] = getBezierPath({
+			sourceX: midX,
+			sourceY: yBot,
+			sourcePosition,
+			targetX,
+			targetY,
+			targetPosition,
+			curvature: 0.25
+		})
+		// Continue from the lane rather than lifting the pen.
+		return `${out} L${midX},${yBot} ${into.replace(/^M/, 'L')}`
 	}
 
 	// Long edges bend out of the source within the layer gap and descend in
@@ -178,7 +188,7 @@
 	path={edgePath}
 	{markerEnd}
 	{style}
-	interactionWidth={0}
+	interactionWidth={12}
 	label={undefined}
 	labelStyle={undefined}
 />
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
index e719bfe2bd..d0835b2880 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
@@ -2,9 +2,14 @@
 	import { Handle, Position } from '@xyflow/svelte'
 	import { twMerge } from 'tailwind-merge'
 	import AssetGenericIcon from '$lib/components/icons/AssetGenericIcon.svelte'
-	import { formatShortAssetPath, type AssetKind } from '$lib/components/assets/lib'
-	import { NODE } from '$lib/components/graph/util'
-	import PipelineInsertMenu, { type PipelineInsertPick } from './PipelineInsertMenu.svelte'
+	import { formatAssetKind, formatShortAssetPath, type AssetKind } from '$lib/components/assets/lib'
+	import PipelineNodeCard from './PipelineNodeCard.svelte'
+	import NodeActionsMenu from './NodeActionsMenu.svelte'
+	import NodeFixButton, { type NodeFix } from './NodeFixButton.svelte'
+	import NodeOnDot from './NodeOnDot.svelte'
+	import { PIPELINE_NODE_HEADER } from './assetGraphLayout'
+	import AddDownstreamMenu from './AddDownstreamMenu.svelte'
+	import AddDownstreamPill from './AddDownstreamPill.svelte'
 	import {
 		ArrowUpRight,
 		Code2,
@@ -12,19 +17,28 @@
 		History,
 		Play,
 		Loader2,
-		Plus,
 		ShieldCheck,
 		ShieldAlert,
 		CheckCircle2,
+		ChevronDown,
+		Pencil,
+		CircleSlash,
+		Trash2,
+		Upload,
 		XCircle
 	} from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
 	import type { ScriptLang } from '$lib/gen'
 	import { enterpriseLicense } from '$lib/stores'
-	import { sendUserToast } from '$lib/utils'
-	import { PIPELINE_LANGUAGES } from './pipelineLanguages'
+	import { sendUserToast, type Item } from '$lib/utils'
 	import type { PipelineOutputKind } from './pipelineTemplates'
 	import type { DbtAssetProvenance } from './types'
 	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
+	import LanguageIcon from '$lib/components/common/languageIcons/LanguageIcon.svelte'
+	import RunStateChip from './RunStateChip.svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import { upstreamScriptItems } from './upstreamScriptItems'
+	import type { RunnableRunState } from './activeRunnables.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
@@ -33,6 +47,49 @@
 	// `content` / `language` so the page-level run handler can dispatch to
 	// `runScriptPreview` instead of `runScriptByPath` (which 404s for
 	// non-deployed scripts).
+	/** What starts a producing script, as its chip shows it. */
+	export type TriggerChipData = {
+		label: string
+		/** The native trigger kind; a data upload renders as a call to action. */
+		kind?: string
+		/** No chip: the node's incoming edges already show what starts it. */
+		hidden?: boolean
+		missing?: boolean
+		draft?: boolean
+		/** Opens the trigger's editor; unset for what has none (manual, asset change). */
+		onOpen?: () => void
+		selected?: boolean
+	}
+
+	export type AssetUpstreamChips =
+		| { none: true }
+		| {
+				multiple: true
+				/** The producing scripts; one when only its triggers are ambiguous. */
+				scripts: Array<{
+					runnableId: string
+					path: string
+					summary?: string
+					language?: ScriptLang
+					unsaved?: boolean
+					onOpen: () => void
+				}>
+				/** The scripts' own triggers, each named with its script. */
+				triggers: Array<TriggerChipData & { script: string }>
+				selected?: boolean
+		  }
+		| {
+				runnableId: string
+				path: string
+				summary?: string
+				language?: ScriptLang
+				unsaved?: boolean
+				runState?: RunnableRunState
+				trigger: TriggerChipData
+				onOpen: () => void
+				selected?: boolean
+		  }
+
 	export type AssetProducer = {
 		kind: 'script' | 'flow'
 		path: string
@@ -51,6 +108,8 @@
 			// "current view of <dim>" marker so it reads as a derived node, not an
 			// unrelated table.
 			derived_from?: string
+			// Why the node is misconfigured, when it is: renders it red.
+			error?: string
 			// dbt provenance when this warehouse table is a dbt node: which model
 			// it is, how dbt materializes it, its tags and its generic tests.
 			dbt?: DbtAssetProvenance
@@ -65,10 +124,14 @@
 				language: ScriptLang,
 				scriptPath: string,
 				outputKind: PipelineOutputKind,
-				aiPrompt?: string
+				aiPrompt?: string,
+				options?: import('./PipelineInsertMenu.svelte').PipelineInsertOptions
 			) => void
 			pathPrefix?: string
 			defaultPathSuffix?: string
+			/** Starts dragging the "+" onto a script (subscribing it to this asset)
+			 * or onto the blank canvas (opening the add menu there). */
+			onStartFeedDrag?: (e: PointerEvent) => void
 			// Producer scripts/flows that write to this asset, supplied by
 			// the canvas from the graph's write/rw edges. Drives the on-hover
 			// "Run" button. Includes unsaved/draft producers so the button
@@ -99,6 +162,41 @@
 			// instead of only settling once the job ends.
 			runStatus?: 'running' | 'materialized' | 'failed'
 			runRowCount?: number | null
+			/** Set in the assets-only view, where the producing script and its
+			 * trigger are folded into the asset: `none` for an asset nothing in the
+			 * pipeline writes, `multiple` when the producer or its trigger is
+			 * ambiguous. */
+			upstream?: AssetUpstreamChips
+			/** What is wrong with the node, and how to fix it: replaces the "+". */
+			fix?: NodeFix
+			/** Assets-only: errors of the scripts and triggers folded into this node. */
+			foldedFixes?: NodeFix[]
+			/** Assets-only: starts dragging the top dot onto an asset, subscribing the
+			 * scripts that build this one to it. */
+			onStartOnDrag?: (e: PointerEvent) => void
+			/** The assets-only node for the scripts that build no asset. */
+			noAsset?: boolean
+			/** The No-asset node's script, by its file name. */
+			noAssetName?: string
+			/** Assets-only: the node is only its script's banner. */
+			bannerOnly?: boolean
+			/** Assets-only: a script folded into the node has an error. */
+			scriptError?: boolean
+			/** No script in the workspace writes it; a flow's write fires no asset trigger. */
+			neverWritten?: boolean
+			/** Card width in the assets-only view, sized to its text. */
+			width?: number
+			/** Assets-only view: the producing script and trigger no other asset
+			 * shares, which the menu offers to delete one by one or together. */
+			upstreamDelete?: import('./assetsOnlyView').AssetUpstreamDelete
+			/** When no combined delete is possible: the folded scripts, each deletable
+			 * on its own. */
+			scriptDeletes?: Array<{ path: string; unsaved: boolean }>
+			triggerDeletes?: Array<NonNullable<import('./assetsOnlyView').AssetUpstreamDelete['trigger']>>
+			onDeleteUpstream?: (target: import('./assetsOnlyView').AssetUpstreamDelete) => void
+			deleteVerb?: 'Delete' | 'Archive'
+			/** Why nothing can be deleted, when the producer is shared. */
+			deleteBlocked?: string
 		}
 		// SvelteFlow injects this on the node component when the user clicks
 		// the node. Combined with our own `hovered` state to drive the
@@ -140,19 +238,94 @@
 		}
 	}
 
-	function handlePick(pick: PipelineInsertPick) {
-		if (pick.kindId === 'pipeline_script' && pick.language && pick.path) {
-			data.onAddScript?.(
-				{ kind: data.asset_kind, path: data.path },
-				pick.language as ScriptLang,
-				pick.path,
-				(pick.outputKind ?? 'none') as PipelineOutputKind,
-				pick.aiPrompt
-			)
-		}
-	}
 
-	let showAdd = $derived(data.onAddScript != undefined)
+
+	// A red asset needs fixing where its error comes from, not a downstream step;
+	// and a step downstream of what nothing writes would never run on its writes.
+	let showAdd = $derived(data.onAddScript != undefined && !data.error && !data.neverWritten)
+	let menuItems: Item[] = $derived(
+		data.onDeleteUpstream && data.upstreamDelete
+			? deleteItems(data.upstreamDelete, data.onDeleteUpstream)
+			: data.onDeleteUpstream && (data.scriptDeletes?.length || data.triggerDeletes?.length)
+				? [
+						...(data.scriptDeletes ?? []).map((script) => ({ script })),
+						...(data.triggerDeletes ?? []).map((trigger) => ({ trigger }))
+					].flatMap((t) => deleteItems(t, data.onDeleteUpstream!))
+				: data.deleteBlocked
+				? [
+						{
+							displayName: `Can't delete: ${data.deleteBlocked}`,
+							icon: Trash2,
+							disabled: true
+						}
+					]
+				: []
+	)
+	const lastSegment = (p: string) => p.split('/').pop() ?? p
+	// A script is archived rather than deleted when the user may not delete it;
+	// a trigger is always deleted.
+	function deleteItems(
+		t: import('./assetsOnlyView').AssetUpstreamDelete,
+		run: (target: import('./assetsOnlyView').AssetUpstreamDelete) => void
+	): Item[] {
+		const items: Item[] = []
+		if (t.script) {
+			const script = t.script
+			items.push({
+				displayName: `${data.deleteVerb ?? 'Delete'} script ${lastSegment(script.path)}`,
+				icon: Trash2,
+				type: 'delete' as const,
+				action: () => run({ script })
+			})
+		}
+		if (t.trigger) {
+			const trigger = t.trigger
+			items.push({
+				displayName: `Delete ${trigger.kind} trigger ${lastSegment(trigger.path)}`,
+				icon: Trash2,
+				type: 'delete' as const,
+				action: () => run({ trigger })
+			})
+		}
+		if (t.script && t.trigger) {
+			items.push({
+				displayName: `${data.deleteVerb === 'Archive' ? 'Remove' : 'Delete'} all 2 items`,
+				icon: Trash2,
+				type: 'delete' as const,
+				action: () => run(t)
+			})
+		}
+		return items
+	}
+	let upstream = $derived(data.upstream)
+	let HEADER_SELECTED = $derived(
+		data.scriptError
+			? 'bg-red-200 dark:bg-red-600 hover:bg-red-200 dark:hover:bg-red-600'
+			: 'bg-surface-accent-selected hover:bg-surface-accent-selected text-accent'
+	)
+	const CHIP_SELECTED =
+		'bg-surface-accent-selected border-border-selected hover:bg-surface-accent-selected text-accent'
+	let producer = $derived(upstream && 'path' in upstream ? upstream : undefined)
+	let coProducers = $derived(upstream && 'scripts' in upstream ? upstream.scripts : [])
+	let hasHeader = $derived(!!producer || coProducers.length > 0)
+	// The corner controls sit on the card's corner, below the header tab:
+	// -top-2 plus PIPELINE_NODE_HEADER (22px).
+	const CARD_CORNER_TOP = 'top-[14px]'
+	let coSelected = $derived(!!(upstream && 'scripts' in upstream && upstream.selected))
+	let coProducerItems = $derived(
+		upstreamScriptItems(coProducers, (path) => coProducers.find((s) => s.path === path)?.onOpen())
+	)
+	let scriptMenuOpen = $state(false)
+	let coTriggers = $derived(upstream && 'triggers' in upstream ? upstream.triggers : [])
+	let coTriggerItems: Item[] = $derived(
+		coTriggers.map((t) => ({
+			displayName: `${t.label}${t.draft ? ' · draft' : ''}`,
+			description: coProducers.length > 1 ? t.script : undefined,
+			disabled: !t.onOpen,
+			action: () => t.onOpen?.()
+		}))
+	)
+	let triggerMenuOpen = $state(false)
 
 	// dbt badge. `materialized` is dbt's own word rather than the Windmill
 	// strategy because `view` and `ephemeral` have no strategy, and showing the
@@ -220,6 +393,185 @@
 	)
 </script>
 
+{#snippet scriptHeader()}
+	<!-- The script building this asset, folded into it: a strip across the top
+	     naming it, which opens it. Several scripts open a menu to pick one. -->
+	{@const one = producer ?? (coProducers.length === 1 ? coProducers[0] : undefined)}
+	{@const headerClass = twMerge(
+		'flex items-center gap-1.5 w-full min-w-0 px-2 text-3xs font-normal leading-none text-secondary hover:bg-surface-hover hover:text-primary',
+		data.scriptError &&
+			'bg-red-100 dark:bg-red-700 text-red-700 dark:text-red-200 hover:bg-red-200 dark:hover:bg-red-600 hover:text-red-800'
+	)}
+	{#if one}
+		{@const isSelected = producer ? !!producer.selected : coSelected}
+		<button
+			type="button"
+			class={twMerge(headerClass, isSelected && HEADER_SELECTED)}
+			title={`Open ${one.summary ? `${one.summary} (${one.path})` : one.path}${one.unsaved ? ' · draft' : ''}`}
+			onpointerdown={(e) => e.stopPropagation()}
+			onkeydown={(e) => e.stopPropagation()}
+			onclick={(e) => {
+				e.stopPropagation()
+				one.onOpen()
+			}}
+		>
+			{#if one.language}
+				<LanguageIcon lang={one.language} width={11} height={11} />
+			{:else}
+				<Code2 size={11} class="shrink-0" />
+			{/if}
+			<span class="truncate">{one.summary || one.path}</span>
+			{#if one.unsaved}<span class="shrink-0 text-tertiary">draft</span>{/if}
+			{#if producer?.runState}
+				<RunStateChip runState={producer.runState} class="ml-auto h-4 px-1 rounded" />
+			{/if}
+			<Pencil size={10} class={twMerge('shrink-0 opacity-70', !producer?.runState && 'ml-auto')} />
+		</button>
+	{:else if coProducers.length > 1}
+		<!-- svelte-ignore a11y_no_static_element_interactions -->
+		<div
+			class="w-full min-w-0 flex"
+			onpointerdown={(e) => e.stopPropagation()}
+			onkeydown={(e) => e.stopPropagation()}
+		>
+			<DropdownV2
+				items={coProducerItems}
+				placement="bottom-start"
+				bind:open={scriptMenuOpen}
+				fixedHeight={false}
+				usePointerDownOutside
+				enableFlyTransition
+				class="w-full"
+			>
+				{#snippet buttonReplacement()}
+					<span
+						class={twMerge(headerClass, 'h-full', (coSelected || scriptMenuOpen) && HEADER_SELECTED)}
+						title={`Built by ${coProducers.length} scripts: pick one to open`}
+					>
+						{#each coProducers.slice(0, 2) as sc (sc.path)}
+							{#if sc.language}
+								<LanguageIcon lang={sc.language} width={11} height={11} />
+							{:else}
+								<Code2 size={11} class="shrink-0" />
+							{/if}
+						{/each}
+						<span class="truncate">{coProducers.length} scripts</span>
+						<ChevronDown size={11} class="shrink-0 ml-auto" />
+					</span>
+				{/snippet}
+			</DropdownV2>
+		</div>
+	{/if}
+{/snippet}
+
+{#snippet upstreamRow()}
+	{#if data.foldedFixes?.length}
+		<!-- A folded script or trigger is misconfigured: its Fix, one at a time. -->
+		<NodeFixButton
+			chip
+			fix={data.foldedFixes[0]}
+			label={`${data.foldedFixes.length} error${data.foldedFixes.length === 1 ? '' : 's'} · Fix`}
+		/>
+	{:else if upstream && coTriggers.length > 1 && !coTriggers.some((t) => t.onOpen)}
+		<!-- Several triggers, none editable here (View mode): a plain label. -->
+		<span
+			class="truncate rounded-md border px-1.5 py-1 text-3xs leading-none font-normal border-gray-300 dark:border-gray-600 text-secondary"
+			>Multiple triggers</span
+		>
+	{:else if upstream && coTriggers.length > 1}
+		<!-- Several triggers start what builds this asset: one chip, a menu to pick
+		     the one to edit. -->
+		<!-- svelte-ignore a11y_no_static_element_interactions -->
+		<div
+			class="min-w-0 flex"
+			onpointerdown={(e) => e.stopPropagation()}
+			onkeydown={(e) => e.stopPropagation()}
+		>
+			<DropdownV2
+				items={coTriggerItems}
+				placement="bottom-start"
+				bind:open={triggerMenuOpen}
+				fixedHeight={false}
+				usePointerDownOutside
+				enableFlyTransition
+			>
+				{#snippet buttonReplacement()}
+					<span
+						class={twMerge(
+							'flex items-center gap-1 min-w-0 rounded-md border px-1.5 py-1 text-3xs leading-none font-normal border-gray-300 dark:border-gray-600 text-secondary bg-surface hover:bg-surface-hover cursor-pointer',
+							(triggerMenuOpen || coTriggers.some((t) => t.selected)) && CHIP_SELECTED
+						)}
+						title="Started by several triggers: pick one to edit"
+					>
+						<span class="truncate">Multiple triggers</span>
+						<ChevronDown size={9} class="shrink-0 opacity-70" />
+					</span>
+				{/snippet}
+			</DropdownV2>
+		</div>
+	{:else if upstream}
+		{@const trigger = producer?.trigger ?? coTriggers[0]}
+		{@const triggerScript = producer?.path ?? coTriggers[0]?.script}
+		{@const chipClass = twMerge(
+			'truncate rounded-md border px-1.5 py-1 text-3xs leading-none font-normal',
+			trigger?.missing
+				? 'border-red-300 dark:border-red-600 text-red-700 dark:text-red-300'
+				: 'border-gray-300 dark:border-gray-600 text-secondary',
+			trigger?.draft && 'border-dashed',
+			trigger?.onOpen && 'bg-surface hover:bg-surface-hover cursor-pointer',
+			trigger?.selected && CHIP_SELECTED
+		)}
+		{#if trigger?.kind === 'data_upload' && trigger.onOpen}
+			<!-- The one trigger that needs the user: nothing runs until a file is
+			     provided, so it reads as the node's main action rather than a chip. -->
+			<!-- svelte-ignore a11y_no_static_element_interactions -->
+			<span
+				class="flex min-w-0"
+				onpointerdown={(e) => e.stopPropagation()}
+				onkeydown={(e) => e.stopPropagation()}
+			>
+				<Button
+					variant="accent"
+					unifiedSize="sm"
+					startIcon={{ icon: Upload }}
+					title={`Upload the data ${triggerScript} runs on`}
+					onClick={(e) => {
+						e?.stopPropagation()
+						trigger.onOpen?.()
+					}}
+				>
+					Upload data
+				</Button>
+			</span>
+		{:else if trigger?.onOpen}
+			<button
+				type="button"
+				class={twMerge(chipClass, 'flex items-center gap-1 min-w-0')}
+				title={trigger.missing
+					? `No ${trigger.label} trigger targets ${triggerScript} yet: click to create one`
+					: `Edit the ${trigger.label} trigger`}
+				onpointerdown={(e) => e.stopPropagation()}
+				onkeydown={(e) => e.stopPropagation()}
+				onclick={(e) => {
+					e.stopPropagation()
+					trigger.onOpen?.()
+				}}
+			>
+				<span class="truncate">{trigger.label}{trigger.draft ? ' · draft' : ''}</span>
+				{#if !trigger.missing}<Pencil size={9} class="shrink-0 opacity-70" />{/if}
+			</button>
+		{:else}
+			<span class={chipClass}>
+				{#if 'none' in upstream}
+					External source
+				{:else if trigger}
+					{trigger.label}{trigger.draft ? ' · draft' : ''}
+				{/if}
+			</span>
+		{/if}
+	{/if}
+{/snippet}
+
 <!-- onmouseenter/leave on the wrapper (not the inner card) so the run
      button — which floats outside the card — keeps the hover state alive
      when the cursor moves between the card and the button. -->
@@ -236,123 +588,169 @@
 			<div class="wm-recompute-flash pointer-events-none absolute inset-0 z-10 rounded-md"></div>
 		{/key}
 	{/if}
-	<!-- Mirrors the flow editor's asset pill: quiet surface + gray border at
-	     rest, accent reserved for the selected state. -->
-	<div
-		class={twMerge(
-			'flex items-center rounded-md drop-shadow-sm overflow-hidden border',
-			'bg-surface-secondary border-gray-400 dark:border-gray-600 hover:border-gray-500 dark:hover:border-gray-500 transition-colors',
-			selected && 'bg-surface-accent-selected border-border-selected'
+	<NodeActionsMenu
+		items={menuItems}
+		hover={hovered}
+		kebabClass={twMerge(
+			showGuardBadge && '-right-8',
+			hasHeader && !data.bannerOnly && CARD_CORNER_TOP
 		)}
-		style="width: {NODE.width}px; min-height: {NODE.height}px;"
-		title={data.path}
 	>
-		<!-- Data identity carries the accent (luminance blue), pairing with
-		     the blue write edges that produce these assets — scripts stay
-		     neutral, so script vs data reads at a glance. -->
-		<AssetGenericIcon
-			assetKind={data.asset_kind}
-			class={`shrink-0 ml-2 mr-2 ${selected ? 'text-accent' : 'text-blue-600 dark:text-blue-400'}`}
-			size="14px"
-		/>
-		{#if data.runStatus}
-			<!-- The run in view, per relation: a spinner while its producer is
-			     building it, then its outcome. Left of the name so the eye finds
-			     the moving nodes first on a wide graph. -->
-			<span
-				class="shrink-0 mr-1 {data.runStatus === 'failed'
-					? 'text-red-600 dark:text-red-400'
-					: data.runStatus === 'materialized'
-						? 'text-green-600 dark:text-green-400'
-						: 'text-blue-600 dark:text-blue-400'}"
-				title={data.runStatus}
+		{#if data.bannerOnly}
+			<!-- A script that builds nothing and runs only on writes to what it reads:
+			     the incoming edges say how it starts, so its banner is the whole node. -->
+			<div
+				class={twMerge(
+					'flex items-stretch min-w-0 rounded-md overflow-hidden bg-surface border border-gray-200 dark:border-gray-700 drop-shadow-sm',
+					(producer ? producer.selected : coSelected) &&
+						'border-border-selected dark:border-border-selected'
+				)}
+				style="width: {data.width ?? 160}px; height: {PIPELINE_NODE_HEADER}px;"
 			>
-				{#if data.runStatus === 'running'}
-					<Loader2 size={11} class="animate-spin" />
-				{:else if data.runStatus === 'failed'}
-					<XCircle size={11} />
+				{@render scriptHeader()}
+			</div>
+		{:else}
+		<PipelineNodeCard
+			kindLabel={data.noAsset ? 'No asset' : formatAssetKind(asset)}
+			title={data.noAsset ? (data.noAssetName ?? '') : formatShortAssetPath(asset)}
+			tooltip={data.noAsset
+				? 'This script builds no asset'
+				: data.error
+					? `${data.path}: ${data.error}`
+					: data.path}
+			{selected}
+			tone={data.error ? 'error' : undefined}
+			subtitle={data.foldedFixes?.length ||
+			(upstream &&
+				!producer?.trigger?.hidden &&
+				!('triggers' in upstream && upstream.triggers.length === 0))
+				? upstreamRow
+				: undefined}
+			header={hasHeader ? scriptHeader : undefined}
+			headerTone={data.scriptError ? 'error' : undefined}
+			headerSelected={producer ? !!producer.selected : coSelected}
+			width={data.width}
+			surface={upstream ? 'primary' : 'secondary'}
+		>
+			{#snippet icon()}
+				<!-- Data identity carries the accent (luminance blue), pairing with
+				     the blue write edges that produce these assets — scripts stay
+				     neutral, so script vs data reads at a glance. -->
+				{#if data.noAsset}
+					<CircleSlash size={14} class="text-tertiary" />
 				{:else}
-					<CheckCircle2 size={11} />
+					<AssetGenericIcon
+						assetKind={data.asset_kind}
+						class={data.error
+							? 'text-red-600 dark:text-red-200'
+							: selected
+								? 'text-accent'
+								: 'text-blue-600 dark:text-blue-400'}
+						size="14px"
+					/>
 				{/if}
-			</span>
-			<!-- Rows the run wrote. Recorded per relation already, and the cheapest
-			     answer to "did this model actually produce anything" — a model that
-			     built green but emitted 0 rows is the failure that looks like a
-			     success. Only once settled: mid-build the number is not yet real. -->
-			{#if data.runStatus === 'materialized' && data.runRowCount != undefined}
-				<span
-					class="shrink-0 mr-1 text-3xs tabular-nums text-tertiary"
-					title="{data.runRowCount} rows written by this run"
-				>
-					{Intl.NumberFormat().format(data.runRowCount)}
-				</span>
-			{/if}
-		{/if}
-		<span class="flex-1 min-w-0 pr-1 py-0.5 text-2xs font-mono text-emphasis truncate">
-			{formatShortAssetPath(asset)}
-		</span>
-		<!-- Fork data-environment chip: in a fork every asset shares its parent's
-		     name, so the env it resolves to must read at a glance. Labeled + tinted
-		     (amber "parent" = deferred read of the parent's current table via a
-		     view; emerald "fork" = the fork's own materialized copy) rather than a
-		     bare icon, which was too easy to miss. The title carries the detail. -->
-		{#if data.fork_materialization === 'deferred'}
-			<span
-				class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold uppercase tracking-wide bg-amber-100 dark:bg-amber-900/40 text-amber-700 dark:text-amber-300 border border-amber-300 dark:border-amber-700"
-				title="Deferred to parent workspace: reads the parent's current data. Materialize it in this fork to iterate on it."
-			>
-				<ArrowUpRight size={10} />
-				parent
-			</span>
-		{:else if data.fork_materialization === 'fork'}
-			<span
-				class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold uppercase tracking-wide bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300 border border-emerald-300 dark:border-emerald-700"
-				title="Materialized in this fork: reads and writes use the fork's isolated copy."
-			>
-				<GitFork size={10} />
-				fork
-			</span>
-		{/if}
-		<!-- dbt chip: names the materialization dbt declares, plus a test count
-		     when the model carries generic tests. Orange keeps it visually
-		     separate from the fork/SCD2 chips, which describe Windmill state.
-		     Where the project node is on the graph it also stands in for the edge
-		     to it: hovering lights that node up, clicking selects it. Where it is
-		     not — the run page, and a pipeline holding a dbt project — there is
-		     nothing to point at, so the chip renders inert. -->
-		{#if data.dbt}
-			<button
-				type="button"
-				class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold tracking-wide bg-orange-100 dark:bg-orange-900/40 text-orange-700 dark:text-orange-300 border border-orange-300 dark:border-orange-700 {data.onDbtSelect
-					? 'hover:brightness-95 cursor-pointer'
-					: 'cursor-default'}"
-				title={dbtTitle}
-				onmouseenter={() => data.onDbtHover?.(true)}
-				onmouseleave={() => data.onDbtHover?.(false)}
-				onclick={(e) => {
-					e.stopPropagation()
-					data.onDbtSelect?.()
-				}}
-			>
-				<DbtIcon width={9} height={9} />
-				{dbtLabel}
-				{#if data.dbt.data_tests?.length}
-					<span class="opacity-70">&middot; {data.dbt.data_tests.length}T</span>
+			{/snippet}
+			{#snippet leading()}
+				{#if data.runStatus}
+					<!-- The run in view, per relation: a spinner while its producer is
+				     building it, then its outcome. Left of the name so the eye finds
+				     the moving nodes first on a wide graph. -->
+					<span
+						class="shrink-0 mr-1 {data.runStatus === 'failed'
+							? 'text-red-600 dark:text-red-400'
+							: data.runStatus === 'materialized'
+								? 'text-green-600 dark:text-green-400'
+								: 'text-blue-600 dark:text-blue-400'}"
+						title={data.runStatus}
+					>
+						{#if data.runStatus === 'running'}
+							<Loader2 size={11} class="animate-spin" />
+						{:else if data.runStatus === 'failed'}
+							<XCircle size={11} />
+						{:else}
+							<CheckCircle2 size={11} />
+						{/if}
+					</span>
+					<!-- Rows the run wrote. Recorded per relation already, and the cheapest
+				     answer to "did this model actually produce anything" — a model that
+				     built green but emitted 0 rows is the failure that looks like a
+				     success. Only once settled: mid-build the number is not yet real. -->
+					{#if data.runStatus === 'materialized' && data.runRowCount != undefined}
+						<span
+							class="shrink-0 mr-1 text-3xs tabular-nums text-tertiary"
+							title="{data.runRowCount} rows written by this run"
+						>
+							{Intl.NumberFormat().format(data.runRowCount)}
+						</span>
+					{/if}
 				{/if}
-			</button>
+			{/snippet}
+			{#snippet trailing()}
+				<!-- Fork data-environment chip: in a fork every asset shares its parent's
+			     name, so the env it resolves to must read at a glance. Labeled + tinted
+			     (amber "parent" = deferred read of the parent's current table via a
+			     view; emerald "fork" = the fork's own materialized copy) rather than a
+			     bare icon, which was too easy to miss. The title carries the detail. -->
+				{#if data.fork_materialization === 'deferred'}
+					<span
+						class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold uppercase tracking-wide bg-amber-100 dark:bg-amber-900/40 text-amber-700 dark:text-amber-300 border border-amber-300 dark:border-amber-700"
+						title="Deferred to parent workspace: reads the parent's current data. Materialize it in this fork to iterate on it."
+					>
+						<ArrowUpRight size={10} />
+						parent
+					</span>
+				{:else if data.fork_materialization === 'fork'}
+					<span
+						class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold uppercase tracking-wide bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300 border border-emerald-300 dark:border-emerald-700"
+						title="Materialized in this fork: reads and writes use the fork's isolated copy."
+					>
+						<GitFork size={10} />
+						fork
+					</span>
+				{/if}
+				<!-- dbt chip: names the materialization dbt declares, plus a test count
+			     when the model carries generic tests. Orange keeps it visually
+			     separate from the fork/SCD2 chips, which describe Windmill state.
+			     Where the project node is on the graph it also stands in for the edge
+			     to it: hovering lights that node up, clicking selects it. Where it is
+			     not — the run page, and a pipeline holding a dbt project — there is
+			     nothing to point at, so the chip renders inert. -->
+				{#if data.dbt}
+					<button
+						type="button"
+						class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold tracking-wide bg-orange-100 dark:bg-orange-900/40 text-orange-700 dark:text-orange-300 border border-orange-300 dark:border-orange-700 {data.onDbtSelect
+							? 'hover:brightness-95 cursor-pointer'
+							: 'cursor-default'}"
+						title={dbtTitle}
+						onmouseenter={() => data.onDbtHover?.(true)}
+						onmouseleave={() => data.onDbtHover?.(false)}
+						onclick={(e) => {
+							e.stopPropagation()
+							data.onDbtSelect?.()
+						}}
+					>
+						<DbtIcon width={9} height={9} />
+						{dbtLabel}
+						{#if data.dbt.data_tests?.length}
+							<span class="opacity-70">&middot; {data.dbt.data_tests.length}T</span>
+						{/if}
+					</button>
+				{/if}
+				<!-- SCD2 companion marker: this node is the `<dim>_current` "latest row
+			     per key" view its producer maintains alongside the base dimension.
+			     Icon-only (the pill already truncates); the title names the base. -->
+				{#if data.derived_from}
+					<span
+						class="shrink-0 mr-1.5 text-violet-600 dark:text-violet-400"
+						title={`SCD2 current view of ${data.derived_from}: latest row per key, maintained by the same producer as the base dimension.`}
+					>
+						<History size={12} />
+					</span>
+				{/if}
+			{/snippet}
+		</PipelineNodeCard>
 		{/if}
-		<!-- SCD2 companion marker: this node is the `<dim>_current` "latest row
-		     per key" view its producer maintains alongside the base dimension.
-		     Icon-only (the pill already truncates); the title names the base. -->
-		{#if data.derived_from}
-			<span
-				class="shrink-0 mr-1.5 text-violet-600 dark:text-violet-400"
-				title={`SCD2 current view of ${data.derived_from}: latest row per key, maintained by the same producer as the base dimension.`}
-			>
-				<History size={12} />
-			</span>
-		{/if}
-	</div>
+	</NodeActionsMenu>
 	{#if showGuardBadge}
 		<!-- Data-test outcome badge. Floats off the TOP-RIGHT corner (opposite the
 		     left-edge run button and the bottom + inserter) so it never collides
@@ -361,6 +759,7 @@
 		<div
 			class={twMerge(
 				'absolute -top-2 -right-2 z-10 rounded-full w-5 h-5 grid place-items-center border shadow-sm',
+				hasHeader && CARD_CORNER_TOP,
 				guardClass
 			)}
 			title={guardTitle}
@@ -376,7 +775,13 @@
 		     cards. Drafts are runnable too via runScriptPreview, so no
 		     greyed-out state — the page-supplied callback handles the
 		     dispatch. -->
-		<div class="absolute -left-3 top-1/2 -translate-y-1/2 z-10">
+		<!-- Centred on the card, below the header tab when there is one. -->
+		<div
+			class={twMerge(
+				'absolute -left-3 top-1/2 -translate-y-1/2 z-10',
+				hasHeader && !data.bannerOnly && 'top-[calc(50%+11px)]'
+			)}
+		>
 			<button
 				type="button"
 				onclick={runProducers}
@@ -398,53 +803,47 @@
 			</button>
 		</div>
 	{/if}
-	{#if showAdd}
-		<!-- Always-visible + below the asset for downstream pipeline-script
-		     creation. Half-overlapping the bottom edge so it visually attaches
-		     to the node like the flow editor's between-step inserter. -->
+	{#if data.onStartOnDrag}
+		<NodeOnDot onStart={data.onStartOnDrag} visible={hovered} />
+	{/if}
+	{#if data.fix}
+		<!-- A red node's way out replaces its "+": adding downstream of a broken
+		     node is not what it needs. -->
 		<div class="absolute left-1/2 -bottom-3 -translate-x-1/2 z-10">
-			<PipelineInsertMenu
-				kinds={[
-					{
-						id: 'pipeline_script',
-						label: 'Add downstream pipeline script',
-						description: 'Triggered when this asset changes',
-						icon: Code2
-					}
-				]}
-				languages={PIPELINE_LANGUAGES as any}
-				pathPrefix={data.pathPrefix ?? ''}
-				defaultPathSuffix={data.defaultPathSuffix ?? ''}
-				onPick={handlePick}
+			<NodeFixButton fix={data.fix} />
+		</div>
+	{:else if showAdd}
+		<!-- Always-visible + on the asset's bottom edge for downstream pipeline-
+		     script creation, half-overlapping it like the flow editor's
+		     between-step inserter. -->
+		<div class="absolute left-1/2 -bottom-3 -translate-x-1/2 z-10">
+			<AddDownstreamMenu
+				asset={{ kind: data.asset_kind, path: data.path }}
+				onAddScript={data.onAddScript!}
+				pathPrefix={data.pathPrefix}
+				defaultPathSuffix={data.defaultPathSuffix}
 			>
-				{#snippet trigger()}
-					<!--
-						Sizing notes for the round + button:
-						  - w-6/h-6 (24px) chosen so that with border-2 (2px each
-						    side) the inner area is exactly 20px — divisible by
-						    the 16px icon to leave a 2px gap on every side. At
-						    20px / 12px before, the gap was 4px-each but the
-						    odd rounding interacted badly with svelte-flow's
-						    fractional zoom transforms and the icon drifted
-						    half a pixel off-center on certain zoom levels.
-						  - `grid place-items-center` instead of flex centering:
-						    flex's baseline alignment introduces a sub-pixel
-						    nudge on small elements that grid avoids.
-						  - `leading-none` strips the default line-height
-						    contribution that the SVG inherits via the parent's
-						    text rendering, otherwise the icon is shifted
-						    downward by ~0.5px at fractional zooms.
-					-->
+				{#snippet trigger({ open })}
+					<!-- A click opens the menu; a drag goes to the canvas, which
+					     tells a real drag from a click by how far the pointer moves. -->
 					<button
 						type="button"
+						class="nopan nodrag block"
 						onclick={(e) => e.stopPropagation()}
-						class="bg-surface border border-gray-400 dark:border-gray-600 text-secondary hover:bg-surface-hover rounded-full w-6 h-6 grid place-items-center shadow-sm leading-none"
-						title="Add downstream pipeline script"
+						onpointerdown={(e) => {
+							if (e.button !== 0) return
+							e.preventDefault()
+							data.onStartFeedDrag?.(e)
+						}}
+						aria-label="Add downstream step"
+						title={data.onStartFeedDrag
+							? 'Click to add a downstream step, or drag onto a script to run it after each write'
+							: undefined}
 					>
-						<Plus size={16} strokeWidth={2.5} />
+						<AddDownstreamPill expanded={open} />
 					</button>
 				{/snippet}
-			</PipelineInsertMenu>
+			</AddDownstreamMenu>
 		</div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/DucklakeAssetPanel.svelte b/frontend/src/lib/components/assets/AssetGraph/DucklakeAssetPanel.svelte
index 5f7ad050e4..65bd86258d 100644
--- a/frontend/src/lib/components/assets/AssetGraph/DucklakeAssetPanel.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/DucklakeAssetPanel.svelte
@@ -11,7 +11,8 @@
 	// can't be read), so a selectable version always exists in the table.
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { Table2, History, Columns3 } from 'lucide-svelte'
+	import { Table2, History, Columns3, Database } from 'lucide-svelte'
+	import DBManagerContent from '$lib/components/DBManagerContent.svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { resource } from 'runed'
 	import { fetchDucklakeSnapshots } from '$lib/components/dbOps'
@@ -31,7 +32,7 @@
 	}
 	let { path, workspace, schemaCanEvolve = true }: Props = $props()
 
-	let tab = $state<'partitions' | 'history' | 'schema'>('partitions')
+	let tab = $state<'data' | 'partitions' | 'history' | 'schema'>('data')
 	// The user's explicit snapshot pick (undefined until they click a row).
 	let selectedVersion = $state<number | undefined>(undefined)
 
@@ -72,24 +73,28 @@
 </script>
 
 <div class="flex flex-col h-full">
-	{#if !qualifiedTable}
-		<!-- Catalog-level ducklake node (no table segment, e.g. `ducklake://main`):
-		     snapshot history / time-travel are per-table, so only the partition
-		     grid applies here. -->
-		<PartitionStatusGrid {path} {workspace} />
-	{:else}
-		<div class="flex items-center gap-2 px-3 py-2 border-b shrink-0">
-			<ToggleButtonGroup selected={tab} on:selected={(e) => (tab = e.detail)}>
-				{#snippet children({ item })}
-					<ToggleButton size="sm" value="partitions" label="Partitions" icon={Table2} {item} />
+	<div class="flex items-center gap-2 px-3 py-2 border-b shrink-0">
+		<ToggleButtonGroup selected={tab} on:selected={(e) => (tab = e.detail)}>
+			{#snippet children({ item })}
+				<ToggleButton size="sm" value="data" label="Data" icon={Database} {item} />
+				<ToggleButton size="sm" value="partitions" label="Partitions" icon={Table2} {item} />
+				<!-- Snapshot history and time-travel are per table: a catalog-level node
+				     (`ducklake://main`, no table segment) has only its data and partitions. -->
+				{#if qualifiedTable}
 					<ToggleButton size="sm" value="schema" label="Schema" icon={Columns3} {item} />
 					<ToggleButton size="sm" value="history" label="History" icon={History} {item} />
-				{/snippet}
-			</ToggleButtonGroup>
-		</div>
+				{/if}
+			{/snippet}
+		</ToggleButtonGroup>
+	</div>
 
-		<div class="flex-1 min-h-0">
-			{#if tab === 'partitions'}
+	<div class="flex-1 min-h-0">
+		{#if tab === 'data' && parsed}
+			<!-- Keyed on the asset: the manager opens its table once, on mount. -->
+			{#key path}
+				<DBManagerContent input={parsed} {workspace} />
+			{/key}
+		{:else if tab === 'partitions' || !qualifiedTable}
 				<PartitionStatusGrid {path} {workspace} />
 			{:else if tab === 'schema'}
 				<SchemaHistoryPanel {path} {workspace} canEvolve={schemaCanEvolve} />
@@ -117,7 +122,6 @@
 						</Pane>
 					</Splitpanes>
 				</div>
-			{/if}
-		</div>
-	{/if}
+		{/if}
+	</div>
 </div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/InitialFitView.svelte b/frontend/src/lib/components/assets/AssetGraph/InitialFitView.svelte
index eea1fb306d..2f8c0cdfe7 100644
--- a/frontend/src/lib/components/assets/AssetGraph/InitialFitView.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/InitialFitView.svelte
@@ -25,6 +25,8 @@
 		if (!nodesInitialized.current) return
 		if (!nodes.some((n) => n.type !== 'add')) return
 		fittedFor = fitKey
-		void fitView({ padding: 0.1, maxZoom: 1 })
+		// A re-fit over nodes that keep their ids finds them already measured, one
+		// render before their new positions reach the flow.
+		requestAnimationFrame(() => void fitView({ padding: 0.1, maxZoom: 1 }))
 	})
 </script>
diff --git a/frontend/src/lib/components/assets/AssetGraph/NodeActionsMenu.svelte b/frontend/src/lib/components/assets/AssetGraph/NodeActionsMenu.svelte
new file mode 100644
index 0000000000..dcb32aa00e
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/NodeActionsMenu.svelte
@@ -0,0 +1,68 @@
+<!--
+@component
+A pipeline node's actions, reachable two ways: the kebab revealed on hover at the
+node's top-right corner, and a right-click menu over the node carrying the same
+items. Place it inside the node's `relative` wrapper, around the node's card.
+-->
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+	import { twMerge } from 'tailwind-merge'
+	import { EllipsisVertical } from 'lucide-svelte'
+	import { stopPropagation, preventDefault } from 'svelte/legacy'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import ContextMenu from '$lib/components/common/contextmenu/ContextMenu.svelte'
+	import { contextMenuItemsFromMenu } from '$lib/components/common/contextmenu/fromMenuItems'
+	import type { Item } from '$lib/utils'
+
+	interface Props {
+		items: Item[]
+		/** The pointer is over the node: shows the kebab. */
+		hover: boolean
+		/** Moves the kebab, for a node with its own badge on that corner. */
+		kebabClass?: string
+		children: Snippet
+	}
+
+	let { items, hover, kebabClass, children }: Props = $props()
+
+	let menuOpen = $state(false)
+	let contextItems = $derived(contextMenuItemsFromMenu(items))
+</script>
+
+{#if items.length > 0}
+	<ContextMenu items={contextItems}>
+		{@render children()}
+	</ContextMenu>
+	<!-- Rendered only on hover or while open, so the canvas stays clean at rest.
+	     `pointerdown` is stopped so svelte-flow doesn't select the node when the
+	     user reaches for the menu. -->
+	<div
+		class={twMerge('absolute -top-2 -right-2 h-7 p-1 min-w-7', kebabClass)}
+		style="will-change: transform;"
+	>
+		<DropdownV2
+			{items}
+			placement="bottom-end"
+			bind:open={menuOpen}
+			fixedHeight={false}
+			usePointerDownOutside
+			enableFlyTransition
+		>
+			{#snippet buttonReplacement()}
+				<button
+					class={twMerge(
+						'center-center p-1 text-secondary shadow-sm bg-surface duration-0 hover:bg-surface-tertiary',
+						hover || menuOpen ? 'block' : '!hidden',
+						'shadow-md rounded-md'
+					)}
+					onpointerdown={stopPropagation(preventDefault(() => {}))}
+					title="Actions"
+				>
+					<EllipsisVertical size={12} />
+				</button>
+			{/snippet}
+		</DropdownV2>
+	</div>
+{:else}
+	{@render children()}
+{/if}
diff --git a/frontend/src/lib/components/assets/AssetGraph/NodeFixButton.svelte b/frontend/src/lib/components/assets/AssetGraph/NodeFixButton.svelte
new file mode 100644
index 0000000000..6e3ba8b8ee
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/NodeFixButton.svelte
@@ -0,0 +1,124 @@
+<!--
+@component
+The "Fix" pill on the bottom edge of a misconfigured (red) pipeline node: what is
+wrong, and the actions that fix it. Styled like the node's "+" pill; the node's
+red fill already says something is wrong.
+-->
+<script lang="ts" module>
+	export type NodeFixAction = {
+		label: string
+		/** The side effect, spelled out: what changes, where. */
+		detail?: string
+		/** `anchor`: where the Fix pill sits, for an action opening a menu there. */
+		run: (anchor: { x: number; y: number }) => void
+	}
+	/** Prose, with the entities it names as links that select them. */
+	export type FixExplainer = Array<string | { text: string; onClick: () => void }>
+	export type NodeFix = { explainer: FixExplainer; actions: NodeFixAction[] }
+
+	/** A fix as its supplier declares it: an action, or opening the schedule
+	 * wizard (which the canvas owns). */
+	export type NodeFixSpec = {
+		explainer: FixExplainer
+		actions: Array<{
+			label: string
+			detail?: string
+			run?: () => void
+			/** Opens the schedule wizard for this script; its confirm calls `onSchedule`. */
+			scheduleFor?: {
+				script: string
+				onSchedule: (s: import('./PipelineInsertMenu.svelte').PipelineInsertSchedule) => void
+			}
+		}>
+	}
+</script>
+
+<script lang="ts">
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import { Button } from '$lib/components/common'
+	import { Wrench } from 'lucide-svelte'
+
+	let {
+		fix,
+		label = 'Fix',
+		chip = false
+	}: {
+		fix: NodeFix
+		label?: string
+		/** A small chip in a node's text, rather than the pill on its edge. */
+		chip?: boolean
+	} = $props()
+
+	let open = $state(false)
+	let anchorEl: HTMLElement | undefined = $state()
+</script>
+
+<!-- svelte-ignore a11y_no_static_element_interactions -->
+<div
+	bind:this={anchorEl}
+	onpointerdown={(e) => e.stopPropagation()}
+	onkeydown={(e) => e.stopPropagation()}
+	onclick={(e) => e.stopPropagation()}
+>
+	<Popover
+		bind:isOpen={open}
+		placement="bottom"
+		enableFlyTransition
+		usePointerDownOutside
+		contentClasses="p-3 w-96"
+	>
+		{#snippet trigger()}
+			{#if chip}
+				<span
+					class="flex items-center gap-1 rounded-md border px-1.5 py-1 text-3xs leading-none font-normal whitespace-nowrap bg-surface border-red-300 dark:border-red-600 text-red-700 dark:text-red-300 hover:bg-surface-hover"
+				>
+					<Wrench size={10} class="shrink-0" />
+					{label}
+				</span>
+			{:else}
+				<span
+					class="h-6 px-2 rounded-full flex items-center gap-1 bg-surface border border-gray-400 dark:border-gray-600 text-secondary hover:text-primary hover:border-gray-500 shadow-sm text-2xs font-normal leading-none whitespace-nowrap"
+				>
+					<Wrench size={12} class="shrink-0" />
+					{label}
+				</span>
+			{/if}
+		{/snippet}
+		{#snippet content()}
+			<div class="flex flex-col gap-3">
+				<p class="text-xs text-primary">
+					{#each fix.explainer as part}
+						{#if typeof part === 'string'}{part}{:else}<button
+								type="button"
+								class="text-accent hover:underline"
+								onclick={() => {
+									open = false
+									part.onClick()
+								}}>{part.text}</button
+							>{/if}
+					{/each}
+				</p>
+				<div class="flex flex-col gap-2">
+					{#each fix.actions as action, i (action.label)}
+						<div class="flex flex-col gap-0.5">
+							<Button
+								variant={i === 0 ? 'accent' : 'default'}
+								unifiedSize="sm"
+								onclick={() => {
+									const r = anchorEl?.getBoundingClientRect()
+									open = false
+									action.run({ x: r ? r.left + r.width / 2 : 0, y: r ? r.bottom : 0 })
+								}}
+							>
+								{action.label}
+							</Button>
+							{#if action.detail}
+								<span class="text-2xs text-secondary">{action.detail}</span>
+							{/if}
+						</div>
+					{/each}
+				</div>
+			</div>
+		{/snippet}
+	</Popover>
+</div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/NodeOnDot.svelte b/frontend/src/lib/components/assets/AssetGraph/NodeOnDot.svelte
new file mode 100644
index 0000000000..25d84b9197
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/NodeOnDot.svelte
@@ -0,0 +1,23 @@
+<!--
+@component
+The dot on a pipeline node's top edge: dragged onto an asset, it makes the node's
+script run after each write to that asset.
+-->
+<script lang="ts">
+	let { onStart, visible }: { onStart: (e: PointerEvent) => void; visible: boolean } = $props()
+</script>
+
+<button
+	type="button"
+	class="absolute -top-1.5 left-1/2 -translate-x-1/2 z-10 w-3 h-3 rounded-full bg-surface border-2 border-blue-500 cursor-crosshair transition-opacity {visible
+		? 'opacity-100'
+		: 'opacity-0'}"
+	title="Drag onto an asset to run after each write to it"
+	aria-label="Drag onto an asset to run after each write to it"
+	onpointerdown={(e) => {
+		e.stopPropagation()
+		e.preventDefault()
+		onStart(e)
+	}}
+	onclick={(e) => e.stopPropagation()}
+></button>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PanToNode.svelte b/frontend/src/lib/components/assets/AssetGraph/PanToNode.svelte
index 83df60b340..22acd606cb 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PanToNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PanToNode.svelte
@@ -2,6 +2,7 @@
 	import { useSvelteFlow, type Node } from '@xyflow/svelte'
 	import { untrack } from 'svelte'
 	import { NODE } from '$lib/components/graph/util'
+	import { PIPELINE_NODE_HEIGHT } from './assetGraphLayout'
 
 	// Smoothly pans the viewport so a freshly-created node lands in the middle,
 	// keeping the current zoom. Lives inside <SvelteFlow> so useSvelteFlow() has
@@ -27,8 +28,8 @@
 		untrack(() => {
 			const node = ns.find((n) => n.id === id)
 			if (!node) return // not laid out yet — re-runs when `nodes` updates
-			const cx = node.position.x + NODE.width / 2
-			const cy = node.position.y + NODE.height / 2
+			const cx = node.position.x + (node.measured?.width ?? NODE.width) / 2
+			const cy = node.position.y + PIPELINE_NODE_HEIGHT / 2
 			const key = `${id}:${cx}:${cy}`
 			if (key === lastKey) return
 			lastKey = key
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineActivityPanel.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineActivityPanel.svelte
index 7e6c34adc2..d1e44a6924 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineActivityPanel.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineActivityPanel.svelte
@@ -416,7 +416,7 @@
 					onmouseenter={() => onHoverRun?.([e.path])}
 					onmouseleave={() => onHoverRun?.(undefined)}
 					class={twMerge(
-						'w-full flex items-center gap-2 px-2 py-1 rounded-sm hover:bg-surface-hover text-xs text-left',
+						'w-full flex items-center gap-2 px-2 py-1.5 rounded-sm font-normal hover:bg-surface-hover text-xs text-left',
 						isMember && 'pl-7',
 						expanded && 'bg-surface-selected'
 					)}
@@ -445,7 +445,7 @@
 					{:else}
 						<Code2 size={12} class="shrink-0 text-tertiary" />
 					{/if}
-					<span class="flex-1 min-w-0 truncate font-mono text-2xs" title={e.path}>
+					<span class="flex-1 min-w-0 truncate text-xs" title={e.path}>
 						{e.path}
 					</span>
 					{#if showSource}
@@ -533,7 +533,7 @@
 						onclick={() => toggleGroup(g.key)}
 						onmouseenter={() => onHoverRun?.(g.members.map((m) => m.path))}
 						onmouseleave={() => onHoverRun?.(undefined)}
-						class="w-full flex items-center gap-2 px-2 py-1 rounded-sm hover:bg-surface-hover text-xs text-left"
+						class="w-full flex items-center gap-2 px-2 py-1.5 rounded-sm font-normal hover:bg-surface-hover text-xs text-left"
 						title={collapsed ? 'Expand cascade runs' : 'Collapse cascade runs'}
 					>
 						<span class="shrink-0 text-tertiary">
@@ -549,7 +549,7 @@
 							{/if}
 						</span>
 						<Workflow size={12} class="shrink-0 text-indigo-500" />
-						<span class="flex-1 min-w-0 truncate font-mono text-2xs" title={groupTitle(g)}>
+						<span class="flex-1 min-w-0 truncate text-xs" title={groupTitle(g)}>
 							{groupTitle(g)}
 						</span>
 						<span
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte
deleted file mode 100644
index 495e9a34bd..0000000000
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte
+++ /dev/null
@@ -1,40 +0,0 @@
-<script lang="ts">
-	import { base } from '$lib/base'
-	import Alert from '$lib/components/common/alert/Alert.svelte'
-	import Button from '$lib/components/common/button/Button.svelte'
-	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
-	import { BookOpen } from 'lucide-svelte'
-
-	const DBT_DOCS = 'https://www.windmill.dev/docs/getting_started/scripts_quickstart/dbt'
-</script>
-
-<Alert type="info" title="Prefer using dbt? Windmill also runs dbt" size="xs">
-	<div class="flex flex-col gap-2">
-		<p>
-			A pipeline is Windmill's own abstraction; an existing dbt project stays a dbt project, and
-			runs here unchanged as its own kind of script, with dbt still owning its models, refs and
-			tests. All it needs is a warehouse configured under
-			<a class="underline" href="{base}/workspace_settings?tab=dbt">Settings → dbt</a>. Its models
-			show up in the asset graph as <span class="font-mono">dbt://</span> nodes, visible next to whatever
-			pipelines you do build, so you can adopt pipelines later, or never.
-		</p>
-		<div class="flex flex-row flex-wrap items-center gap-2">
-			<!-- The dbt mark goes in as a child rather than `startIcon`: that slot
-			     sizes its icon with lucide's `size`, which DbtIcon has no prop for. -->
-			<Button variant="default" unifiedSize="sm" href="{base}/scripts/add?lang=dbt">
-				<DbtIcon width={14} height={14} />
-				New dbt script
-			</Button>
-			<Button
-				variant="subtle"
-				unifiedSize="sm"
-				href={DBT_DOCS}
-				target="_blank"
-				rel="noreferrer"
-				startIcon={{ icon: BookOpen }}
-			>
-				dbt documentation
-			</Button>
-		</div>
-	</div>
-</Alert>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineDeployErrors.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineDeployErrors.svelte
new file mode 100644
index 0000000000..6206ebdf33
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineDeployErrors.svelte
@@ -0,0 +1,49 @@
+<script lang="ts">
+	import { AlertTriangle } from 'lucide-svelte'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+
+	// Which drafts failed to deploy and why, anchored next to the deploy button so
+	// the reasons are one click away without leaving the editor. Deployed drafts
+	// leave the map; what is listed is still unresolved.
+	let {
+		errors,
+		open = $bindable()
+	}: {
+		errors: ReadonlyMap<string, string>
+		open?: boolean
+	} = $props()
+</script>
+
+<Popover
+	placement="bottom-end"
+	contentClasses="p-3 max-w-[480px]"
+	usePointerDownOutside
+	enableFlyTransition
+	bind:isOpen={open}
+>
+	{#snippet trigger()}
+		<button
+			type="button"
+			class="flex items-center gap-1.5 px-2 py-1 rounded-md text-red-600 dark:text-red-400 bg-red-50 dark:bg-red-900/30 hover:bg-red-100 dark:hover:bg-red-900/50 transition-colors text-xs font-medium"
+			title="View save errors"
+		>
+			<AlertTriangle size={14} />
+			<span>{errors.size} failed</span>
+		</button>
+	{/snippet}
+	{#snippet content()}
+		<div class="flex flex-col gap-2">
+			<span class="text-xs font-semibold text-emphasis">Save errors</span>
+			<div class="flex flex-col gap-2 max-h-72 overflow-y-auto">
+				{#each [...errors.entries()] as [path, message] (path)}
+					<div class="flex flex-col gap-0.5 border-l-2 border-red-400 pl-2">
+						<span class="text-2xs font-mono text-emphasis">{path}</span>
+						<span class="text-2xs text-red-600 dark:text-red-400 break-words">
+							{message}
+						</span>
+					</div>
+				{/each}
+			</div>
+		</div>
+	{/snippet}
+</Popover>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineDeployTriggersModal.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineDeployTriggersModal.svelte
new file mode 100644
index 0000000000..d96b758625
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineDeployTriggersModal.svelte
@@ -0,0 +1,47 @@
+<script lang="ts">
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import type { PipelineTriggerDraft } from './types'
+
+	// Triggers start running once deployed, so deploying a pipeline's trigger
+	// drafts asks first, listing what will start.
+	let {
+		open,
+		triggerDrafts,
+		onConfirmed,
+		onCanceled
+	}: {
+		open: boolean
+		triggerDrafts: ReadonlyMap<string, PipelineTriggerDraft>
+		onConfirmed: () => void
+		onCanceled: () => void
+	} = $props()
+</script>
+
+<ConfirmationModal
+	{open}
+	title="Deploy triggers?"
+	confirmationText="Deploy"
+	type="info"
+	{onConfirmed}
+	{onCanceled}
+>
+	<div class="flex flex-col gap-2 text-xs text-secondary">
+		<p>
+			{triggerDrafts.size === 1
+				? 'Saving the pipeline also creates this trigger. It starts running its script once deployed.'
+				: `Saving the pipeline also creates these ${triggerDrafts.size} triggers. They start running their scripts once deployed.`}
+		</p>
+		<ul class="flex flex-col gap-1">
+			{#each [...triggerDrafts] as [key, d] (key)}
+				<li class="flex flex-col">
+					<span class="font-mono text-2xs text-emphasis truncate">{d.config.path}</span>
+					<span class="text-2xs text-hint truncate">
+						{d.kind}{#if d.kind === 'schedule'}
+							· <span class="font-mono">{d.config.schedule}</span> ({d.config.timezone}){/if}
+						→ {d.config.script_path}
+					</span>
+				</li>
+			{/each}
+		</ul>
+	</div>
+</ConfirmationModal>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineFolderList.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineFolderList.svelte
index d35b4f21d6..bb38a0e5bf 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineFolderList.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineFolderList.svelte
@@ -18,11 +18,18 @@
 		mode?: 'view' | 'edit'
 		// Called right before navigating — lets a wrapping modal close itself.
 		onOpen?: () => void
+		// Only the folder picker, for hosts that don't list pipelines.
+		hideExisting?: boolean
 	}
-	let { currentFolder = undefined, mode = 'view', onOpen = undefined }: Props = $props()
+	let {
+		currentFolder = undefined,
+		mode = 'view',
+		onOpen = undefined,
+		hideExisting = false
+	}: Props = $props()
 
 	let pipelines = resource(
-		() => $workspaceStore,
+		() => (hideExisting ? undefined : $workspaceStore),
 		async (ws) => {
 			if (!ws) return [] as ListPipelineFoldersResponse
 			return await AssetService.listPipelineFolders({ workspace: ws })
@@ -49,50 +56,52 @@
 </script>
 
 <div class="flex flex-col gap-6 w-full min-w-0">
-	<section class="flex flex-col gap-2">
-		<h3 class="text-xs font-semibold text-secondary uppercase tracking-wide">
-			Existing pipelines
-		</h3>
-		{#if pipelines.loading && !pipelines.current}
-			<div class="text-tertiary text-sm flex items-center gap-2">
-				<Loader2 size={14} class="animate-spin" />
-				Loading…
-			</div>
-		{:else if pipelines.error}
-			<div class="text-red-500 text-sm">Failed: {pipelines.error.message}</div>
-		{:else if visiblePipelines.length === 0}
-			<div class="text-tertiary text-sm">
-				{currentFolder
-					? 'No other pipelines in this workspace.'
-					: 'No pipelines yet. A pipeline is any folder whose scripts carry pipeline annotations.'}
-			</div>
-		{:else}
-			<div class="flex flex-col border rounded-md overflow-hidden max-h-64 overflow-y-auto">
-				{#each visiblePipelines as p (p.folder)}
-					<button
-						type="button"
-						class="flex items-center justify-between px-3 py-2 border-b last:border-b-0 bg-surface hover:bg-surface-hover transition-colors text-left"
-						onclick={() => openExistingPipeline(p.folder)}
-					>
-						<span class="font-mono text-sm">f/{p.folder}</span>
-						<span class="text-2xs text-tertiary">
-							{p.script_count}
-							{p.script_count === 1 ? 'script' : 'scripts'}
-						</span>
-					</button>
-				{/each}
-			</div>
-		{/if}
-	</section>
+	{#if !hideExisting}
+		<section class="flex flex-col gap-2">
+			<h3 class="text-sm font-semibold text-emphasis">Existing pipelines</h3>
+			{#if pipelines.loading && !pipelines.current}
+				<div class="text-tertiary text-sm flex items-center gap-2">
+					<Loader2 size={14} class="animate-spin" />
+					Loading…
+				</div>
+			{:else if pipelines.error}
+				<div class="text-red-500 text-sm">Failed: {pipelines.error.message}</div>
+			{:else if visiblePipelines.length === 0}
+				<div class="text-tertiary text-sm">
+					{currentFolder
+						? 'No other pipelines in this workspace.'
+						: 'No pipelines yet. A pipeline is any folder whose scripts carry pipeline annotations.'}
+				</div>
+			{:else}
+				<div class="flex flex-col border rounded-md overflow-hidden max-h-64 overflow-y-auto">
+					{#each visiblePipelines as p (p.folder)}
+						<button
+							type="button"
+							class="flex items-center justify-between px-3 py-2 border-b last:border-b-0 bg-surface hover:bg-surface-hover transition-colors text-left"
+							onclick={() => openExistingPipeline(p.folder)}
+						>
+							<span class="font-mono text-sm">f/{p.folder}</span>
+							<span class="text-2xs text-tertiary">
+								{p.script_count}
+								{p.script_count === 1 ? 'script' : 'scripts'}
+							</span>
+						</button>
+					{/each}
+				</div>
+			{/if}
+		</section>
+	{/if}
 
 	{#if !$userStore?.operator}
 		<!-- Operators only view existing pipelines — opening an arbitrary
 		     folder is a build-a-new-pipeline affordance. -->
-		<section class="flex flex-col gap-2">
-			<h3 class="text-xs font-semibold text-secondary uppercase tracking-wide">
-				Pick or create a folder
-			</h3>
-			<div class="flex items-center gap-2">
+		<section class="flex flex-col gap-1">
+			<h3 class="text-sm font-semibold text-emphasis">Pick or create a folder</h3>
+			<p class="text-xs text-secondary">
+				Each folder holds one pipeline, made of its pipeline scripts. Pick a folder to open its
+				pipeline, or create one to start a new pipeline.
+			</p>
+			<div class="flex items-center gap-2 mt-1">
 				<div class="flex-1 min-w-0">
 					<FolderPicker bind:folderName={pickedFolder} />
 				</div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte
index b71a51ea0a..364c4c6221 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte
@@ -1,6 +1,15 @@
 <script lang="ts">
 	import { untrack, type Snippet } from 'svelte'
-	import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
+	import { MousePointerClick } from 'lucide-svelte'
+	import Disposable from '$lib/components/common/drawer/Disposable.svelte'
+	import Portal from '$lib/components/Portal.svelte'
+	import { getOverlayHost } from '$lib/components/common/overlayHost.svelte'
+	import { useFlowPanelMode } from '$lib/components/flows/flowPanelMode.svelte'
+	import {
+		PIPELINE_DRAFT_KIND,
+		pipelineBundlePath,
+		pipelineLocalMirrorKey
+	} from '$lib/pipelinePaths'
 	import { Loader2 } from 'lucide-svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { DraftService } from '$lib/gen'
@@ -11,6 +20,11 @@
 	import type { ColumnLineageGraph } from './columnLineageGraph'
 	import HideButton from '$lib/components/apps/editor/settingsPanel/HideButton.svelte'
 	import AssetGraphCanvas from './AssetGraphCanvas.svelte'
+	import { TRIGGER_NODE_STYLE } from './TriggerNode.svelte'
+	import { describeSchedule } from '$lib/utils/describeCron'
+	import type { UpstreamTriggerAction } from './upstreamScriptItems'
+	import type { AssetUpstreamDelete } from './assetsOnlyView'
+	import type { NodeFixSpec } from './NodeFixButton.svelte'
 	import AssetGraphDetailsPane from './AssetGraphDetailsPane.svelte'
 	import PipelineEventLog from './PipelineEventLog.svelte'
 	import type {
@@ -18,8 +32,10 @@
 		AssetGraphSelection,
 		NativeTriggerKind,
 		PipelineMode,
+		PipelineTriggerDraft,
 		DbtAssetProvenance
 	} from './types'
+	import { isDraftableTriggerKind, triggerDraftKey } from './pipelineTriggerDrafts'
 	import type { AssetKind, Script, ScriptLang } from '$lib/gen'
 	import type { RunnableRunState, PipelineEvent } from './activeRunnables.svelte'
 	import type { PipelineOutputKind } from './pipelineTemplates'
@@ -41,6 +57,7 @@
 		defaultPathSuffix = 'new_pipeline_script',
 		panelHidden = false,
 		onTogglePanelHidden,
+		modalPanel = false,
 		prefetchingAssets = false,
 		hoveredPaths = [],
 		selectedRunPaths = [],
@@ -65,6 +82,11 @@
 		onAddScriptForAsset,
 		onAddPipelineScript,
 		onRunnableMenuRemove,
+		onDeleteAssetUpstream,
+		nodeFixes,
+		assetDeleteVerb,
+		onEdgeAction,
+		onAddAssetTrigger,
 		onRunProducer,
 		idlePane,
 		onRequestEdit,
@@ -73,6 +95,9 @@
 		onRunCascadeByPath,
 		runFormInitialArgs,
 		onRunFormArgsChange,
+		inputsOnly = false,
+		onRunInputs,
+		onShowScript,
 		readyDataUploadPaths,
 		resolveLocalScript,
 		localScriptsVersion,
@@ -126,6 +151,9 @@
 		pathPrefix: string
 		defaultPathSuffix?: string
 		panelHidden?: boolean
+		/** Let the details pane open as a modal over a full-width graph when the editor
+		 * is too narrow to dock it — the flow editor's step panel rule. */
+		modalPanel?: boolean
 		onTogglePanelHidden?: () => void
 		prefetchingAssets?: boolean
 		hoveredPaths?: string[]
@@ -153,16 +181,29 @@
 			language: ScriptLang,
 			scriptPath: string,
 			outputKind: PipelineOutputKind,
-			aiPrompt?: string
+			aiPrompt?: string,
+			options?: import('./PipelineInsertMenu.svelte').PipelineInsertOptions
 		) => void
 		onAddPipelineScript?: (
 			language: ScriptLang,
 			path: string,
 			source: { kind: NativeTriggerKind; path: string | undefined },
 			outputKind: PipelineOutputKind,
-			aiPrompt?: string
+			aiPrompt?: string,
+			options?: import('./PipelineInsertMenu.svelte').PipelineInsertOptions
 		) => void
 		onRunnableMenuRemove?: (...args: any[]) => void
+		onDeleteAssetUpstream?: (target: AssetUpstreamDelete) => void
+		nodeFixes?: ReadonlyMap<string, NodeFixSpec>
+		assetDeleteVerb?: 'Delete' | 'Archive'
+		onEdgeAction?: (a: {
+			action: 'listen' | 'stop'
+			targets: Array<{ script: string; asset: { kind: AssetKind; path: string }; reads: boolean }>
+		}) => void
+		onAddAssetTrigger?: (a: {
+			scripts: Array<{ script: string; reads: boolean }>
+			asset: { kind: AssetKind; path: string }
+		}) => void
 		onRunProducer?: (producer: RunProducer) => Promise<string | undefined>
 		idlePane?: Snippet
 		onRequestEdit?: () => void
@@ -175,8 +216,16 @@
 		// callback to persist them as they change — see the page's dataUploadArgs.
 		runFormInitialArgs?: Record<string, any>
 		onRunFormArgsChange?: (path: string, args: Record<string, any>, isValid: boolean) => void
+		/** See AssetGraphDetailsPane's `inputsOnly`. */
+		inputsOnly?: boolean
+		onRunInputs?: (
+			path: string,
+			args: Record<string, any>,
+			live?: { content: string; language: ScriptLang }
+		) => Promise<string | undefined>
+		onShowScript?: () => void
 		// Data-upload entry scripts whose staged upload is ready (green node).
-		readyDataUploadPaths?: Set<string>
+		readyDataUploadPaths?: ReadonlySet<string>
 		/** Local-dev (`/pipeline_dev`): resolve a node to its working-tree content
 		 * so the details pane skips the (nonexistent) deployed-script fetch. May
 		 * be async (to infer the args schema for the run form). */
@@ -247,18 +296,81 @@
 			? (editor.selection != undefined || editor.activeDraftPath != undefined) && !panelHidden
 			: !panelHidden
 	)
+	// Docked beside the graph, or in a modal over it (modal mode). In modal mode the
+	// details only show once asked for: a double-click on a node, a click on the
+	// node already selected, or a script's open button — never on a selection the
+	// editor makes itself (an AI-built node), which would pop a modal unasked.
+	const panelController = useFlowPanelMode({ enabled: () => modalPanel })
+	$effect(() => panelController.measure(containerWidth))
+	const panelMode = $derived(panelController.mode)
+	let panelModalOpen = $state(false)
+	const dockedPaneOpen = $derived(detailsPaneOpen && panelMode === 'docked')
+	$effect(() => {
+		if (untrack(() => panelModalOpen) && (panelMode === 'docked' || !detailsPaneOpen)) {
+			panelModalOpen = false
+		}
+	})
+	let panelDisposable: Disposable | undefined = $state(undefined)
+	// Disposable joins the overlay stack through its methods, not by watching `open`.
+	$effect(() => {
+		panelModalOpen
+		untrack(() => {
+			panelModalOpen ? panelDisposable?.openDrawer() : panelDisposable?.closeDrawer()
+		})
+	})
+	const overlayHost = getOverlayHost()
+	const modalHost = $derived(overlayHost?.el())
+
+	function selectableNodeAt(e: MouseEvent): HTMLElement | null {
+		return (e.target as HTMLElement | null)?.closest('.svelte-flow__node.selectable') ?? null
+	}
+	// Read in the capture phase: once the click bubbles, the canvas has applied
+	// its selection and a first click looks like a click on the selected node.
+	let clickStartedOnSelected = false
+	function noteSelectionBeforeClick(e: MouseEvent) {
+		clickStartedOnSelected = !!selectableNodeAt(e)?.classList.contains('selected')
+	}
+	function openPanelModalIfReselected(e: MouseEvent) {
+		if (clickStartedOnSelected && selectableNodeAt(e)) panelModalOpen = true
+	}
+	function openPanelModalFromGraph(e: MouseEvent) {
+		if (selectableNodeAt(e)) panelModalOpen = true
+	}
+	// A button in the pane that ends it closes the modal in the same update: left to
+	// the effect above, the modal would first render the pane without its selection.
+	function closePanelModal() {
+		if (panelMode === 'modal') panelModalOpen = false
+	}
+	function handleCanvasSelect(s: AssetGraphSelection | undefined, opts?: { open?: boolean }) {
+		onSelect(s)
+		if (opts?.open && s && panelMode === 'modal') panelModalOpen = true
+	}
+	// A data-upload node's click asks for its run form; in modal mode nothing shows
+	// it unless the modal opens too.
+	$effect(() => {
+		if (focusUploadSignal > 0 && untrack(() => panelMode) === 'modal') {
+			untrack(() => (panelModalOpen = true))
+		}
+	})
+	const showNodeHint = $derived(panelMode === 'modal' && !panelModalOpen)
+	const nodeHintText = $derived(
+		effectiveSelection
+			? 'Click the selected node to open it'
+			: 'Double click a node to open it'
+	)
+
 	let idleView = $derived(
 		mode !== 'edit' && editor.selection == undefined && editor.activeDraftPath == undefined
 	)
 
 	// Wrap the writes (and the rightPaneSize read in the else branch) in untrack so
-	// the effect tracks only `detailsPaneOpen` / `storedRightPaneSize` — without it,
+	// the effect tracks only `dockedPaneOpen` / `storedRightPaneSize` — without it,
 	// the Pane `bind:size` feedback loops the effect and pegs the main thread.
 	$effect(() => {
 		// Stacked (vertical) splits give the details pane more room — the run
 		// form + result need height more than the graph needs it.
 		const fallback = stacked ? 55 : 40
-		if (detailsPaneOpen) {
+		if (dockedPaneOpen) {
 			const restore = storedRightPaneSize
 			untrack(() => {
 				rightPaneSize = restore > 0 ? restore : fallback
@@ -272,6 +384,67 @@
 		}
 	})
 
+	// The selected asset's producing scripts, named and iconed from the graph, for
+	// the pane's "Edit script".
+	let producerScripts = $derived(
+		selectionProducers
+			.filter((p) => p.kind === 'script')
+			.map((p) => {
+				const r = displayGraph.runnables.find((x) => x.usage_kind === 'script' && x.path === p.path)
+				return { path: p.path, summary: r?.summary, language: r?.language }
+			})
+	)
+	// The selected asset's upstream triggers that can be opened from here, each
+	// with the same action its trigger node has: edit (edit mode), create a
+	// missing one (edit mode), or the webhook / data-upload drawers.
+	let producerTriggers = $derived.by((): UpstreamTriggerAction[] => {
+		const scripts = new Set(producerScripts.map((p) => p.path))
+		const seen = new Set<string>()
+		const out: UpstreamTriggerAction[] = []
+		for (const t of displayGraph.triggers ?? []) {
+			if (t.trigger_kind === 'asset' || !scripts.has(t.runnable_path)) continue
+			const kind = t.trigger_kind
+			const rowless = kind === 'webhook' || kind === 'data_upload'
+			const key = `${kind}:${rowless || t.missing ? t.runnable_path : t.path}`
+			if (seen.has(key)) continue
+			seen.add(key)
+			const label = TRIGGER_NODE_STYLE[kind]?.label ?? kind
+			const script = t.runnable_path
+			let action: UpstreamTriggerAction | undefined
+			if (kind === 'webhook') {
+				if (onOpenWebhook)
+					action = { label: 'Open webhook', detail: script, onOpen: () => onOpenWebhook(script) }
+			} else if (kind === 'data_upload') {
+				if (onOpenDataUpload)
+					action = { label: 'Upload data', detail: script, onOpen: () => onOpenDataUpload(script) }
+			} else if (t.missing && !rowless) {
+				if (onCreateMissingTrigger)
+					action = {
+						label: `Create ${label} trigger`,
+						detail: script,
+						onOpen: () => onCreateMissingTrigger(kind, script)
+					}
+			} else if (t.path && onEditTrigger) {
+				const path = t.path
+				action = {
+					label: kind === 'schedule' ? 'Edit schedule' : `Edit ${label} trigger`,
+					detail:
+						kind === 'schedule' && t.schedule
+							? (t.summary ?? describeSchedule(t.schedule, t.timezone) ?? path)
+							: path,
+					onOpen: () => onEditTrigger(kind, path, script)
+				}
+			}
+			if (action) out.push(action)
+		}
+		return out
+	})
+
+	function editProducerScript(path: string) {
+		if (mode !== 'edit') onRequestEdit?.()
+		onSelect({ kind: 'runnable', runnable_kind: 'script', path })
+	}
+
 	// ===================== Draft autosave (persistDrafts only) =====================
 	// All of this folder's in-flight drafts live in ONE per-user DB draft (typ
 	// `data_pipeline`) keyed at the folder, syncing across devices + surfacing in
@@ -279,12 +452,21 @@
 	// for the one-time migration below; the DB is the source of truth on load.
 	// FlowBuilder's autosave analogue — gated by `persistDrafts`.
 	let pipelineDraftPath = $derived(pipelineBundlePath(folder))
-	let storageKey = $derived(`pipeline-${folder}`)
-	type PipelineDraftBundle = { drafts: Array<[string, PipelineDraft]>; activeDraftPath?: string }
+	let storageKey = $derived(pipelineLocalMirrorKey(folder))
+	type PipelineDraftBundle = {
+		drafts: Array<[string, PipelineDraft]>
+		activeDraftPath?: string
+		triggerDrafts?: PipelineTriggerDraft[]
+	}
 	// Hydration is tracked on the editor instance (`editor.hydratedFromDb`), not a
 	// component flag: the in-session preview reuses one instance across editor
 	// hide/show, and it must hydrate ONCE per instance, not on every remount.
 	let lastPersistedBundle: string | undefined = undefined
+	// What decides whether the bundle needs saving: its drafts, not which one is
+	// open. Opening a draft is not an edit, so it rides along with the next real
+	// change instead of saving (and spinning the sync indicator) on a click.
+	const persistKey = (b: PipelineDraftBundle | undefined) =>
+		b ? JSON.stringify({ drafts: b.drafts, triggerDrafts: b.triggerDrafts }) : undefined
 
 	function restoreBundle(bundle: PipelineDraftBundle) {
 		if (Array.isArray(bundle.drafts)) {
@@ -300,6 +482,18 @@
 			if (loaded.size > 0) editor.drafts = loaded
 		}
 		if (typeof bundle.activeDraftPath === 'string') editor.activeDraftPath = bundle.activeDraftPath
+		if (Array.isArray(bundle.triggerDrafts)) {
+			editor.triggerDrafts = new Map(
+				bundle.triggerDrafts
+					.filter(
+						(d) =>
+							isDraftableTriggerKind(d?.kind) &&
+							typeof d.config?.path === 'string' &&
+							typeof d.config?.script_path === 'string'
+					)
+					.map((d) => [triggerDraftKey(d.kind, d.config.path), d])
+			)
+		}
 	}
 
 	function readLocalBundle(): PipelineDraftBundle | undefined {
@@ -311,7 +505,8 @@
 			if (s && (Array.isArray(s.drafts) || typeof s.activeDraftPath === 'string')) {
 				return {
 					drafts: Array.isArray(s.drafts) ? s.drafts : [],
-					activeDraftPath: typeof s.activeDraftPath === 'string' ? s.activeDraftPath : undefined
+					activeDraftPath: typeof s.activeDraftPath === 'string' ? s.activeDraftPath : undefined,
+					triggerDrafts: Array.isArray(s.triggerDrafts) ? s.triggerDrafts : undefined
 				}
 			}
 		} catch (e) {
@@ -339,8 +534,8 @@
 					fromServer = true
 				}
 			}
-			// A folder retarget during the await (the route-page header switcher, or a
-			// session retarget) changed the target and reset hydratedFromDb. Don't
+			// A folder switch during the await (the route page's header switcher)
+			// changed the target and reset hydratedFromDb. Don't
 			// apply this now-stale folder's bundle or mark the new folder hydrated —
 			// otherwise the stale result blocks the new folder's hydrate and its
 			// drafts bleed across folders.
@@ -359,7 +554,7 @@
 				{ workspace: ws ?? '', itemKind: PIPELINE_DRAFT_KIND, path },
 				migratedFromLocal ? undefined : serverSavedAt
 			)
-			if (!migratedFromLocal) lastPersistedBundle = bundle ? JSON.stringify(bundle) : undefined
+			if (!migratedFromLocal) lastPersistedBundle = persistKey(bundle)
 		} catch (e) {
 			console.warn('failed to load pipeline drafts', e)
 		} finally {
@@ -412,30 +607,52 @@
 				return [p, d] as [string, PipelineDraft]
 			return [p, { ...d, script, outputAssets, inputAssets }] as [string, PipelineDraft]
 		})
+		// A deployed script being edited is only promoted to a draft when its pane
+		// closes; until then its buffer is saved as the draft it will become.
+		const { scriptPath: livePath, content: liveBody, base } = editor.liveContent
+		if (
+			livePath != undefined &&
+			base &&
+			!editor.drafts.has(livePath) &&
+			liveBody !== (base.content ?? '')
+		) {
+			const live = editor.liveBodyAssets.scriptPath === livePath
+			const writes = live ? extractWrites(editor.liveBodyAssets.assets) : []
+			serialized.push([
+				livePath,
+				{
+					localId: editor.promotedDraftLocalId(livePath),
+					script: { ...base, content: liveBody },
+					outputAssets: writes.length > 0 ? writes : undefined,
+					inputAssets: live ? extractReads(editor.liveBodyAssets.assets) : undefined
+				}
+			])
+		}
 		const activePath = editor.activeDraftPath
+		const triggerDrafts = [...editor.triggerDrafts.values()]
 		const key = storageKey
 		const ws = workspace
 		const path = pipelineDraftPath
 		const hydrated = editor.hydratedFromDb
 		untrack(() => {
 			if (!hydrated) return
-			const isEmpty = serialized.length === 0 && !activePath
+			const isEmpty = serialized.length === 0 && !activePath && triggerDrafts.length === 0
 			const bundle: PipelineDraftBundle | undefined = isEmpty
 				? undefined
-				: { drafts: serialized, activeDraftPath: activePath }
+				: {
+						drafts: serialized,
+						activeDraftPath: activePath,
+						...(triggerDrafts.length > 0 ? { triggerDrafts } : {})
+					}
 			try {
 				if (typeof localStorage !== 'undefined') {
 					if (isEmpty) localStorage.removeItem(key)
-					else
-						localStorage.setItem(
-							key,
-							encodeState({ drafts: serialized, activeDraftPath: activePath })
-						)
+					else localStorage.setItem(key, encodeState(bundle))
 				}
 			} catch (e) {
 				console.warn('failed to mirror pipeline state', e)
 			}
-			const serializedBundle = bundle ? JSON.stringify(bundle) : undefined
+			const serializedBundle = persistKey(bundle)
 			if (serializedBundle === lastPersistedBundle) return
 			lastPersistedBundle = serializedBundle
 			if (!ws) return
@@ -450,10 +667,90 @@
 	})
 </script>
 
-<div class="h-full w-full" bind:clientWidth={containerWidth}>
+{#snippet detailsBody(ws: string)}
+	{#if idleView && idlePane}
+		{@render idlePane()}
+	{:else}
+		<AssetGraphDetailsPane
+			{mode}
+			{onRequestEdit}
+			{canRunByPath}
+			{onRunByPath}
+			{onRunCascadeByPath}
+			{runFormInitialArgs}
+			{onRunFormArgsChange}
+			{inputsOnly}
+			{onRunInputs}
+			{onShowScript}
+			{resolveLocalScript}
+			{localScriptsVersion}
+			selection={activeDraft ? undefined : editor.selection}
+			selectionProducers={activeDraft ? [] : selectionProducers}
+			{producerScripts}
+			onEditScript={editProducerScript}
+			{producerTriggers}
+			{selectionColumnGraph}
+			{selectionColumnLoading}
+			{selectionColumnTruncated}
+			{selectionColumnFailed}
+			{selectionDbt}
+			{schemaCanEvolve}
+			{selectionForkMaterialization}
+			{schemaContractContext}
+			{runsRefreshKey}
+			{runsPendingJobId}
+			{activeRunnable}
+			{downstreamSubscribers}
+			onStartBoundedRun={canBoundedRunOpenScript &&
+			editor.openScriptPath &&
+			onStartBoundedRunForOpen
+				? () => onStartBoundedRunForOpen?.(editor.openScriptPath!)
+				: undefined}
+			{onRunCompleted}
+			{onTestStateChange}
+			{requestRemoveSignal}
+			{requestRunSignal}
+			{requestRunCascadeSignal}
+			{focusUploadSignal}
+			draftScript={activeDraft?.script}
+			draftOutputAssets={activeDraft?.outputAssets}
+			draftInputAssets={activeDraft?.inputAssets}
+			{onDraftPathChange}
+			onDraftMetaChange={editor.setDraftMeta}
+			{pathPrefix}
+			workspace={ws}
+			onAnnotationsChange={editor.handleAnnotationsChange}
+			onAssetsChange={editor.handleAssetsChange}
+			onContentChange={editor.handleContentChange}
+			onDraftPersist={editor.handleDraftPersist}
+			onclose={() => {
+				closePanelModal()
+				onClose()
+			}}
+			onHide={onTogglePanelHidden &&
+				(() => {
+					closePanelModal()
+					onTogglePanelHidden()
+				})}
+			{onDiscard}
+			{onDraftSaved}
+			{onPersistedSaved}
+			{onScriptRenamed}
+			{onScriptRemoved}
+		/>
+	{/if}
+{/snippet}
+
+<div class="relative h-full w-full" bind:clientWidth={containerWidth}>
 	<Splitpanes class="!h-full" horizontal={stacked}>
 		<Pane bind:size={leftPaneSize}>
-			<div class="relative h-full">
+			<!-- svelte-ignore a11y_click_events_have_key_events, a11y_no_static_element_interactions -->
+			<div
+				class="relative h-full"
+				ondblclick={panelMode === 'modal' ? openPanelModalFromGraph : undefined}
+				onpointerdowncapture={panelMode === 'modal' ? noteSelectionBeforeClick : undefined}
+				onclick={panelMode === 'modal' ? openPanelModalIfReselected : undefined}
+			>
 				<AssetGraphCanvas
 					graph={displayGraph}
 					selection={effectiveSelection}
@@ -470,10 +767,15 @@
 					{onOpenWebhook}
 					{onOpenDataUpload}
 					{readyDataUploadPaths}
-					onselect={onSelect}
+					onselect={handleCanvasSelect}
 					{onAddScriptForAsset}
 					{onAddPipelineScript}
 					{onRunnableMenuRemove}
+					{onDeleteAssetUpstream}
+					{nodeFixes}
+					{assetDeleteVerb}
+					{onEdgeAction}
+					{onAddAssetTrigger}
 					{onRunProducer}
 					{validStartPaths}
 					{onStartBoundedRun}
@@ -482,6 +784,8 @@
 					{panToNodeId}
 					showMinimap={!stacked}
 					viewportFitKey={viewportFitKey ?? folder}
+					assetsOnlyToggle
+					assetsOnlyFolder={workspace ? `${workspace}/${folder}` : undefined}
 				/>
 				{#if boundBar}{@render boundBar()}{/if}
 				{#if mode === 'edit'}
@@ -509,66 +813,47 @@
 				{/if}
 			</div></Pane
 		>
-		{#if detailsPaneOpen && workspace}
+		{#if dockedPaneOpen && workspace}
 			<Pane bind:size={rightPaneSize} minSize={25}>
-				{#if idleView && idlePane}
-					{@render idlePane()}
-				{:else}
-					<AssetGraphDetailsPane
-						{mode}
-						{onRequestEdit}
-						{canRunByPath}
-						{onRunByPath}
-						{onRunCascadeByPath}
-						{runFormInitialArgs}
-						{onRunFormArgsChange}
-						{resolveLocalScript}
-						{localScriptsVersion}
-						selection={activeDraft ? undefined : editor.selection}
-						selectionProducers={activeDraft ? [] : selectionProducers}
-						{selectionColumnGraph}
-						{selectionColumnLoading}
-						{selectionColumnTruncated}
-						{selectionColumnFailed}
-						{selectionDbt}
-						{schemaCanEvolve}
-						{selectionForkMaterialization}
-						{schemaContractContext}
-						{runsRefreshKey}
-						{runsPendingJobId}
-						{activeRunnable}
-						{downstreamSubscribers}
-						onStartBoundedRun={canBoundedRunOpenScript &&
-						editor.openScriptPath &&
-						onStartBoundedRunForOpen
-							? () => onStartBoundedRunForOpen?.(editor.openScriptPath!)
-							: undefined}
-						{onRunCompleted}
-						{onTestStateChange}
-						{requestRemoveSignal}
-						{requestRunSignal}
-						{requestRunCascadeSignal}
-						{focusUploadSignal}
-						draftScript={activeDraft?.script}
-						draftOutputAssets={activeDraft?.outputAssets}
-						draftInputAssets={activeDraft?.inputAssets}
-						{pathPrefix}
-						{onDraftPathChange}
-						{workspace}
-						onAnnotationsChange={editor.handleAnnotationsChange}
-						onAssetsChange={editor.handleAssetsChange}
-						onContentChange={editor.handleContentChange}
-						onDraftPersist={editor.handleDraftPersist}
-						onclose={onClose}
-						onHide={onTogglePanelHidden}
-						{onDiscard}
-						{onDraftSaved}
-						{onPersistedSaved}
-						{onScriptRenamed}
-						{onScriptRemoved}
-					/>
-				{/if}
+				{@render detailsBody(workspace)}
 			</Pane>
 		{/if}
 	</Splitpanes>
+	{#if showNodeHint}
+		<!-- Above the event log's bar, which owns the canvas's bottom edge. -->
+		<div
+			class="pointer-events-none absolute bottom-10 left-3 z-30 flex items-center gap-1.5 text-xs text-hint"
+		>
+			<MousePointerClick size={13} />
+			{nodeHintText}
+		</div>
+	{/if}
 </div>
+
+<!-- Portalled to the host's overlay anchor (a session preview tab) so the modal covers
+     that tab rather than the whole page; Disposable owns its place in the overlay stack
+     and its Escape. -->
+<Disposable bind:open={panelModalOpen} bind:this={panelDisposable}>
+	{#snippet children({ zIndex })}
+		{#if panelMode === 'modal' && panelModalOpen && workspace}
+			<Portal target={modalHost ?? 'body'} class="contents">
+				<!-- svelte-ignore a11y_click_events_have_key_events -->
+				<!-- svelte-ignore a11y_no_static_element_interactions -->
+				<div
+					class="{modalHost ? 'absolute' : 'fixed'} inset-0 flex justify-center px-2 py-6"
+					style="z-index: {zIndex}"
+					role="dialog"
+				>
+					<div class="absolute inset-0 bg-black/20" onclick={() => (panelModalOpen = false)}></div>
+					<div
+						class="relative flex w-full max-w-4xl flex-col overflow-hidden rounded-md border bg-surface shadow-xl"
+					>
+						<div class="min-h-0 flex-1 overflow-auto">
+							{@render detailsBody(workspace)}
+						</div>
+					</div>
+				</div>
+			</Portal>
+		{/if}
+	{/snippet}
+</Disposable>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
index e341707250..56f0877ce0 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
@@ -1,6 +1,7 @@
 <script lang="ts" module>
 	import type { ComponentType } from 'svelte'
 	import type { SupportedLanguage } from '$lib/common'
+	import type { AssetKind, NewSchedule } from '$lib/gen'
 
 	export type PipelineInsertKind = {
 		// Machine-readable id; drives which right-column panel renders.
@@ -8,6 +9,9 @@
 		label: string
 		description?: string
 		icon?: ComponentType
+		// Its trigger is configured in its own editor right after the script is
+		// created, so the wizard's last button reads "Configure".
+		configuredAfterCreate?: boolean
 	}
 
 	export type PipelineInsertPick = {
@@ -22,7 +26,18 @@
 		// from this prompt via AI (using language + outputKind + the
 		// upstream input as context) instead of using the seeded template.
 		aiPrompt?: string
+		// Set by the schedule step when the picked kind is `schedule`.
+		schedule?: PipelineInsertSchedule
+		// Set by the asset step for the table output kinds, replacing the
+		// generated name.
+		outputAsset?: { kind: AssetKind; path: string }
 	}
+
+	export type PipelineInsertOptions = Pick<PipelineInsertPick, 'schedule' | 'outputAsset'>
+
+	// Everything but the target, which is the script being created. An empty
+	// `path` means the default `<script>_schedule`.
+	export type PipelineInsertSchedule = Omit<NewSchedule, 'script_path'>
 </script>
 
 <script lang="ts">
@@ -36,10 +51,28 @@
 		PIPELINE_OUTPUT_KINDS,
 		type PipelineOutputKind
 	} from './pipelineTemplates'
+	import CronInput from '$lib/components/CronInput.svelte'
 	import type { ScriptLang } from '$lib/gen'
 	import Label from '$lib/components/Label.svelte'
-	import TextInput from '$lib/components/text_input/TextInput.svelte'
-	import { CornerDownLeft, Sparkles } from 'lucide-svelte'
+	import TextInput, {
+		inputBaseClass,
+		inputBorderClass,
+		inputSizeClasses
+	} from '$lib/components/text_input/TextInput.svelte'
+	import DucklakePicker from '$lib/components/DucklakePicker.svelte'
+	import DatatablePicker from '$lib/components/DatatablePicker.svelte'
+	import Path from '$lib/components/Path.svelte'
+	import Section from '$lib/components/Section.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import DateTimeInput from '$lib/components/DateTimeInput.svelte'
+	import ScheduleAdvancedOptions, {
+		emptyScheduleAdvanced,
+		loadDefaultScheduleAdvanced,
+		scheduleAdvancedCfg
+	} from '$lib/components/triggers/schedules/ScheduleAdvancedOptions.svelte'
+	import { workspaceStore } from '$lib/stores'
+	import { ArrowLeft, ChevronDown, CornerDownLeft, Loader2, Sparkles } from 'lucide-svelte'
+	import { tick, untrack } from 'svelte'
 	import { arrowTabNav } from '$lib/attachments/arrowTabNav'
 	import { selectAndAdvanceTo } from '$lib/attachments/selectAndAdvanceTo'
 
@@ -49,8 +82,15 @@
 		pathPrefix?: string
 		defaultPathSuffix?: string
 		onPick: (pick: PipelineInsertPick) => void
-		trigger: import('svelte').Snippet
+		/** Receives whether the menu is open, e.g. to keep a hover state while it is. */
+		trigger: import('svelte').Snippet<[{ open: boolean }]>
 		placement?: 'bottom' | 'top' | 'left' | 'right'
+		/** Opens the menu each time it changes, for an entry point other than the trigger. */
+		openSignal?: number
+		/** With `openSignal`: only the schedule step, for this existing script; its
+		 * confirm hands the schedule to `onSchedule` instead of creating a script. */
+		scheduleFor?: string
+		onSchedule?: (schedule: PipelineInsertSchedule) => void
 	}
 
 	let {
@@ -60,7 +100,10 @@
 		trigger: triggerSnippet,
 		placement = 'bottom',
 		defaultPathSuffix,
-		onPick
+		onPick,
+		openSignal,
+		scheduleFor,
+		onSchedule
 	}: Props = $props()
 
 	// When there's only one trigger kind, hide the Trigger column entirely
@@ -75,6 +118,107 @@
 		aiPrompt: undefined as undefined | string
 	})
 	let selected = $state(buildEmptySelected())
+	let menuOpen = $state(false)
+	$effect(() => {
+		if (!openSignal) return
+		untrack(() => {
+			if (scheduleFor) {
+				resetWizard()
+				selected.triggerId = 'schedule'
+				step = 1
+				config.schedulePath = `${scheduleFor}_schedule`
+				loadAdvancedDefaults()
+				void focusCurrentStep()
+			}
+			menuOpen = true
+		})
+	})
+	let selectedKind = $derived(kinds.find((k) => k.id === selected.triggerId))
+
+	// Steps after the first, each configuring something the picks call for.
+	type ConfigStep = 'schedule' | 'asset'
+	const NAMED_OUTPUT_KINDS: PipelineOutputKind[] = ['materialize', 'datatable', 'ducklake']
+	let configSteps = $derived.by<ConfigStep[]>(() => {
+		const steps: ConfigStep[] = []
+		if (selected.triggerId === 'schedule') steps.push('schedule')
+		if (selected.outputId && NAMED_OUTPUT_KINDS.includes(selected.outputId)) steps.push('asset')
+		return steps
+	})
+	// 0 is the trigger/language/output/path step; `n` is `configSteps[n - 1]`.
+	let step = $state(0)
+	let currentConfigStep = $derived(step > 0 ? configSteps[step - 1] : undefined)
+	let isLastStep = $derived(step >= configSteps.length)
+
+	const buildEmptyConfig = () => ({
+		schedule: '0 0 12 * *',
+		timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+		cronVersion: 'v2',
+		validCron: true,
+		// Follows the script path until the Path field is edited.
+		schedulePath: '',
+		schedulePathDirty: false,
+		schedulePathError: '',
+		summary: '',
+		description: '',
+		pauseUntil: false,
+		pausedUntil: undefined as string | undefined,
+		advanced: emptyScheduleAdvanced(),
+		// The workspace's default handlers, loaded when the schedule step opens.
+		advancedDefaults: 'unloaded' as 'unloaded' | 'loading' | 'loaded',
+		// `store` is the data table or DuckLake catalog name. The table name
+		// follows the script name until the user types in it.
+		asset: undefined as
+			| undefined
+			| { kind: 'ducklake' | 'datatable'; store: string | undefined; table: string },
+		tableEdited: false
+	})
+	let config = $state(buildEmptyConfig())
+
+	// A new schedule starts from the workspace's default handlers, as in the schedule
+	// drawer. The step cannot be confirmed until they are in.
+	function loadAdvancedDefaults() {
+		const ws = $workspaceStore
+		if (!ws || config.advancedDefaults !== 'unloaded') return
+		const target = config
+		target.advancedDefaults = 'loading'
+		loadDefaultScheduleAdvanced(ws)
+			.then((d) => (target.advanced = d))
+			.catch(() => {})
+			.finally(() => (target.advancedDefaults = 'loaded'))
+	}
+
+	function resetWizard() {
+		selected = buildEmptySelected()
+		config = buildEmptyConfig()
+		step = 0
+	}
+
+	const TABLE_NAME_RE = /^[^/\s]+$/
+	// The path grammar of `Path.svelte`: word segments, no empty or trailing ones.
+	const SCRIPT_NAME_RE = /^[\w-]+(\/[\w-]+)*$/
+	let scriptNameValid = $derived(SCRIPT_NAME_RE.test(selected.scriptPath.trim()))
+	let assetValid = $derived(!!config.asset?.store && TABLE_NAME_RE.test(config.asset.table.trim()))
+	let stepValid = $derived(
+		currentConfigStep === 'schedule'
+			? config.validCron &&
+					!!config.schedule.trim() &&
+					!config.schedulePathError &&
+					config.advancedDefaults === 'loaded'
+			: currentConfigStep === 'asset'
+				? assetValid
+				: scriptNameValid && !!selected.triggerId && !!selected.language && !!selected.outputId
+	)
+
+	function enterAssetStep() {
+		const kind = selected.outputId === 'datatable' ? 'datatable' : 'ducklake'
+		if (config.asset?.kind !== kind) {
+			config.asset = { kind, store: 'main', table: '' }
+			config.tableEdited = false
+		}
+		if (!config.tableEdited && config.asset) {
+			config.asset.table = selected.scriptPath.trim().split('/').pop() ?? ''
+		}
+	}
 
 	// Refs to the column containers so Enter inside one column can hand
 	// focus off to the first tabbable in the next column.
@@ -104,16 +248,73 @@
 		return out
 	}
 
+	// A step change re-renders the popover body, dropping focus to <body>, where
+	// keystrokes (Enter, Cmd+Enter) no longer reach the step's key handlers.
+	let contentEl: HTMLElement | undefined = $state()
+	async function focusCurrentStep() {
+		await tick()
+		const target =
+			step === 0
+				? pathEl?.querySelector('input')
+				: contentEl?.querySelector<HTMLElement>('[data-autofocus] input')
+		target?.focus()
+	}
+
+	function goBack() {
+		step -= 1
+		void focusCurrentStep()
+	}
+
+	function scheduleConfig(): PipelineInsertSchedule {
+		return {
+			path: config.schedulePath,
+			schedule: config.schedule.trim(),
+			timezone: config.timezone,
+			cron_version: config.cronVersion,
+			summary: config.summary.trim() || undefined,
+			description: config.description,
+			paused_until: config.pauseUntil ? config.pausedUntil : undefined,
+			is_flow: false,
+			args: {},
+			...scheduleAdvancedCfg($state.snapshot(config.advanced))
+		}
+	}
+
 	function confirm(close: () => void) {
+		if (scheduleFor) {
+			if (!stepValid) return
+			onSchedule?.(scheduleConfig())
+			close()
+			return
+		}
 		const suffix = selected.scriptPath.trim()
 		if (!suffix || !selected.triggerId || !selected.language || !selected.outputId) return
+		if (!stepValid) return
+		if (!isLastStep) {
+			step += 1
+			if (configSteps[step - 1] === 'asset') enterAssetStep()
+			if (configSteps[step - 1] === 'schedule') {
+				loadAdvancedDefaults()
+				if (!config.schedulePathDirty) config.schedulePath = `${pathPrefix}${suffix}_schedule`
+			}
+			void focusCurrentStep()
+			return
+		}
 		const trimmedPrompt = selected.aiPrompt?.trim()
 		onPick({
 			kindId: selected.triggerId,
 			language: selected.language,
 			path: pathPrefix + suffix,
 			outputKind: selected.outputId,
-			aiPrompt: trimmedPrompt && trimmedPrompt.length > 0 ? trimmedPrompt : undefined
+			aiPrompt: trimmedPrompt && trimmedPrompt.length > 0 ? trimmedPrompt : undefined,
+			schedule: configSteps.includes('schedule') ? scheduleConfig() : undefined,
+			outputAsset:
+				configSteps.includes('asset') && config.asset
+					? {
+							kind: config.asset.kind as AssetKind,
+							path: `${config.asset.store}/${config.asset.table.trim()}`
+						}
+					: undefined
 		})
 		close()
 	}
@@ -123,9 +324,18 @@
 	enableFlyTransition
 	contentClasses={twMerge(
 		'p-0 bg-surface overflow-hidden relative transition-height',
-		showBottomPanel ? 'h-[26rem]' : 'h-[22rem]'
+		// The first step's columns (w-56 + w-48 + w-80), held across steps.
+		singleKind ? 'w-[32rem]' : 'w-[46rem]',
+		currentConfigStep === 'schedule'
+			? 'h-[27rem]'
+			: currentConfigStep === 'asset'
+				? 'h-[14rem]'
+				: showBottomPanel
+					? 'h-[26rem]'
+					: 'h-[22rem]'
 	)}
 	class="inline-block"
+	bind:isOpen={menuOpen}
 	usePointerDownOutside
 	floatingConfig={{
 		placement,
@@ -136,24 +346,30 @@
 		fitViewport: true,
 		overlap: false
 	}}
-	onClose={() => (selected = buildEmptySelected())}
+	onClose={resetWizard}
 >
 	{#snippet trigger()}
-		{@render triggerSnippet?.()}
+		{@render triggerSnippet?.({ open: menuOpen })}
 	{/snippet}
 	{#snippet content({ close })}
-		<div class="flex flex-col h-full">
-			<div class={'flex flex-row transition-height divide-x overflow-y-scroll'}>
-				{@render topSection()}
-			</div>
-			<div
-				class={twMerge(
-					'flex flex-col gap-5 grow transition-height px-4 border-t',
-					showBottomPanel ? 'h-[14rem] py-4' : 'h-0'
-				)}
-			>
-				{@render bottomSection(close)}
-			</div>
+		<div class="h-full" bind:this={contentEl}>
+			{#if currentConfigStep}
+				{@render configStepSection(currentConfigStep, close)}
+			{:else}
+				<div class="flex flex-col h-full">
+					<div class={'flex flex-row transition-height divide-x overflow-y-scroll'}>
+						{@render topSection()}
+					</div>
+					<div
+						class={twMerge(
+							'flex flex-col gap-5 grow transition-height px-4 border-t',
+							showBottomPanel ? 'h-[14rem] py-4' : 'h-0'
+						)}
+					>
+						{@render bottomSection(close)}
+					</div>
+				</div>
+			{/if}
 		</div>
 	{/snippet}
 </Popover>
@@ -170,7 +386,10 @@
 				<Button
 					variant="subtle"
 					btnClasses={'text-left'}
-					onClick={() => (selected.triggerId = k.id)}
+					onClick={() => {
+						selected.triggerId = k.id
+						if (k.id === 'schedule') loadAdvancedDefaults()
+					}}
 					selected={isSelected}
 				>
 					{#if k.icon}
@@ -264,14 +483,30 @@
 {#snippet bottomSection(close: () => void)}
 	<Label label="Path">
 		<!-- svelte-ignore a11y_no_static_element_interactions -->
-		<div bind:this={pathEl} class="flex" onkeydown={selectAndAdvanceTo(() => aiPromptEl ?? saveEl)}>
+		<div
+			bind:this={pathEl}
+			class="flex"
+			onkeydown={(e) =>
+				(e.metaKey || e.ctrlKey) && e.key === 'Enter'
+					? (e.preventDefault(), e.stopPropagation(), confirm(close))
+					: selectAndAdvanceTo(() => aiPromptEl ?? saveEl)(e)}
+		>
 			<div
 				class="border rounded-md rounded-r-none border-r-0 text-xs w-fit shrink-0 whitespace-nowrap flex items-center px-2 text-secondary bg-surface-input"
 			>
 				{pathPrefix}
 			</div>
-			<TextInput bind:value={selected.scriptPath} class="rounded-l-none" />
+			<TextInput
+				bind:value={selected.scriptPath}
+				class="rounded-l-none"
+				error={!scriptNameValid && !!selected.scriptPath.trim()}
+			/>
 		</div>
+		{#if !scriptNameValid && selected.scriptPath.trim()}
+			<span class="text-2xs text-red-600 dark:text-red-400">
+				Letters, digits, <code>_</code> and <code>-</code>, in <code>/</code>-separated segments
+			</span>
+		{/if}
 	</Label>
 	{#if !$copilotInfo.workspaceDisabled}
 		<Label label="AI Prompt (optional)">
@@ -292,15 +527,217 @@
 			</div>
 		</Label>
 	{/if}
-	{@const hasAiPrompt = !!selected.aiPrompt?.trim()}
 	<div class="ml-auto" bind:this={saveEl}>
-		<Button
-			variant="accent"
-			btnClasses="w-fit"
-			disabled={!selected.scriptPath.trim()}
-			onClick={() => confirm(close)}
-			startIcon={hasAiPrompt ? { icon: Sparkles } : undefined}
-			shortCut={{ Icon: CornerDownLeft }}>{hasAiPrompt ? 'Generate' : 'Create'}</Button
-		>
+		{@render confirmButton(close)}
+	</div>
+{/snippet}
+
+{#snippet confirmButton(close: () => void)}
+	{@const hasAiPrompt = !!selected.aiPrompt?.trim()}
+	<Button
+		variant="accent"
+		btnClasses="w-fit"
+		disabled={!stepValid}
+		onClick={() => confirm(close)}
+		startIcon={isLastStep && hasAiPrompt ? { icon: Sparkles } : undefined}
+		shortCut={{ Icon: CornerDownLeft }}
+		>{scheduleFor
+			? 'Create schedule'
+			: !isLastStep
+				? step === 0
+					? 'Configure'
+					: 'Next'
+				: hasAiPrompt
+					? 'Generate'
+					: selectedKind?.configuredAfterCreate
+						? 'Configure'
+						: 'Create'}</Button
+	>
+{/snippet}
+
+{#snippet configStepSection(configStep: ConfigStep, close: () => void)}
+	<!-- svelte-ignore a11y_no_static_element_interactions -->
+	<div
+		class="flex flex-col h-full"
+		onkeydown={(e) => {
+			if (e.key !== 'Enter') return
+			const target = e.target as HTMLElement | null
+			// Cmd/Ctrl+Enter confirms from anywhere; bare Enter only from the step's own
+			// inputs, not from the Advanced fields (a textarea, pickers with their own Enter).
+			const bareEnterSubmits = target?.tagName === 'INPUT' && !target.closest('[data-advanced]')
+			if (e.metaKey || e.ctrlKey || bareEnterSubmits) {
+				e.preventDefault()
+				e.stopPropagation()
+				confirm(close)
+			}
+		}}
+	>
+		<div class="flex items-center gap-2 px-2 py-2 border-b">
+			{#if !scheduleFor}
+				<Button
+					variant="subtle"
+					unifiedSize="sm"
+					iconOnly
+					startIcon={{ icon: ArrowLeft }}
+					onClick={goBack}
+					title="Back"
+				/>
+			{/if}
+			<span class="text-xs font-semibold text-emphasis {scheduleFor ? 'pl-2' : ''}">
+				{scheduleFor
+					? `Schedule for ${scheduleFor}`
+					: configStep === 'schedule'
+						? 'Schedule'
+						: 'Output asset'}
+			</span>
+			{#if !scheduleFor}
+				<span class="text-2xs text-hint ml-auto pr-2"
+					>Step {step + 1} of {configSteps.length + 1}</span
+				>
+			{/if}
+		</div>
+		<div class="flex flex-col gap-2 grow overflow-auto p-4">
+			{#if configStep === 'schedule'}
+				<span class="text-2xs text-secondary">
+					Saved as a draft schedule and deployed along with the pipeline.
+				</span>
+				<div data-autofocus class="contents">
+					<CronInput
+						bind:schedule={config.schedule}
+						bind:timezone={config.timezone}
+						bind:validCRON={config.validCron}
+						bind:cronVersion={config.cronVersion}
+					/>
+				</div>
+				<div data-advanced class="mt-4">
+					<Section label="Advanced" collapsable initiallyCollapsed>
+						<div class="flex flex-col gap-6">
+							<Label label="Summary">
+								<TextInput
+									bind:value={config.summary}
+									inputProps={{ placeholder: 'Short summary to be displayed when listed' }}
+								/>
+							</Label>
+							<Label label="Path">
+								<Path
+									bind:path={config.schedulePath}
+									bind:dirty={config.schedulePathDirty}
+									bind:error={config.schedulePathError}
+									initialPath=""
+									checkInitialPathExistence
+									namePlaceholder="schedule"
+									kind="schedule"
+								/>
+							</Label>
+							<Label label="Description">
+								<TextInput
+									underlyingInputEl="textarea"
+									bind:value={config.description}
+									inputProps={{ placeholder: 'What this schedule does and how to use it' }}
+								/>
+							</Label>
+							<div class="flex flex-col gap-1">
+								<Toggle
+									options={{
+										right: 'Pause schedule until...',
+										rightTooltip:
+											'Pausing the schedule will program the next job to run as if the schedule starts at the time the pause is lifted, instead of now.'
+									}}
+									bind:checked={config.pauseUntil}
+								/>
+								{#if config.pauseUntil}
+									<DateTimeInput bind:value={config.pausedUntil} />
+								{/if}
+							</div>
+							<!-- Rendered once the workspace defaults are in, so they never
+							     overwrite a handler picked while they load. -->
+							{#if config.advancedDefaults === 'loaded'}
+								<ScheduleAdvancedOptions
+									wsId={$workspaceStore}
+									itemKind="script"
+									canWrite
+									bind:errorHandlerSelected={config.advanced.errorHandlerSelected}
+									bind:errorHandlerPath={config.advanced.errorHandlerPath}
+									bind:errorHandleritemKind={config.advanced.errorHandleritemKind}
+									bind:errorHandlerExtraArgs={config.advanced.errorHandlerExtraArgs}
+									bind:wsErrorHandlerMuted={config.advanced.wsErrorHandlerMuted}
+									bind:failedTimes={config.advanced.failedTimes}
+									bind:failedExact={config.advanced.failedExact}
+									bind:recoveryHandlerSelected={config.advanced.recoveryHandlerSelected}
+									bind:recoveryHandlerPath={config.advanced.recoveryHandlerPath}
+									bind:recoveryHandlerItemKind={config.advanced.recoveryHandlerItemKind}
+									bind:recoveryHandlerExtraArgs={config.advanced.recoveryHandlerExtraArgs}
+									bind:recoveredTimes={config.advanced.recoveredTimes}
+									bind:successHandlerSelected={config.advanced.successHandlerSelected}
+									bind:successHandlerPath={config.advanced.successHandlerPath}
+									bind:successHandlerItemKind={config.advanced.successHandlerItemKind}
+									bind:successHandlerExtraArgs={config.advanced.successHandlerExtraArgs}
+									bind:retry={config.advanced.retry}
+									bind:dynamicSkipPath={config.advanced.dynamicSkipPath}
+									bind:tag={config.advanced.tag}
+								/>
+							{:else}
+								<div class="flex items-center gap-1.5 text-xs text-secondary">
+									<Loader2 size={12} class="animate-spin" />
+									Loading the workspace's default handlers…
+								</div>
+							{/if}
+						</div>
+					</Section>
+				</div>
+			{:else if configStep === 'asset' && config.asset}
+				<Label label="Name">
+					<div
+						class={twMerge(
+							inputBaseClass,
+							inputBorderClass({ error: !assetValid }),
+							inputSizeClasses.md,
+							'flex flex-row items-center gap-0 py-0 pl-2 pr-0'
+						)}
+					>
+						<span class="text-xs text-secondary shrink-0">{config.asset.kind}://</span>
+						{#if config.asset.kind === 'datatable'}
+							<DatatablePicker
+								bind:value={config.asset.store}
+								class="shrink-0"
+								selectInputClass="!border-none"
+								placeholder="data table"
+								useContentEditable
+								RightIcon={ChevronDown}
+							/>
+						{:else}
+							<DucklakePicker
+								bind:value={config.asset.store}
+								class="shrink-0"
+								selectInputClass="!border-none"
+								placeholder="catalog"
+								useContentEditable
+								RightIcon={ChevronDown}
+							/>
+						{/if}
+						<span class="text-sm text-secondary">/</span>
+						<div data-autofocus class="grow flex">
+							<TextInput
+								bind:value={config.asset.table}
+								class="!border-none grow"
+								inputProps={{
+									placeholder: 'table',
+									oninput: () => (config.tableEdited = true)
+								}}
+							/>
+						</div>
+					</div>
+				</Label>
+				<span class="text-2xs text-hint">
+					{config.asset.kind === 'datatable' ? 'Data table' : 'DuckLake catalog'}, then the table
+					name
+				</span>
+			{/if}
+		</div>
+		<div class="flex px-4 py-3 border-t">
+			<div class="ml-auto">
+				{@render confirmButton(close)}
+			</div>
+		</div>
 	</div>
 {/snippet}
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineNodeCard.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineNodeCard.svelte
new file mode 100644
index 0000000000..e78058f905
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineNodeCard.svelte
@@ -0,0 +1,174 @@
+<!--
+@component
+The body every pipeline graph node shares: icon, a kind line ("Script · draft", "Data table"),
+a title, and trailing chips. Node components add only what is theirs — the icon, the chips,
+and the controls hung around the card.
+-->
+<script lang="ts">
+	import { NODE } from '$lib/components/graph/util'
+	import {
+		PIPELINE_NODE_EXTRA_ROW,
+		PIPELINE_NODE_HEADER,
+		PIPELINE_NODE_HEADER_CARD_PAD,
+		PIPELINE_NODE_HEIGHT
+	} from './assetGraphLayout'
+	import { twMerge } from 'tailwind-merge'
+	import type { Snippet } from 'svelte'
+
+	interface Props {
+		icon: Snippet
+		kindLabel: string
+		title: string
+		/** Hover text; the path, when the title is a summary. */
+		tooltip?: string
+		/** Scripts sit on the main surface, assets and triggers a step down; in the
+		 * assets-only view, which has no scripts, assets take the main surface. */
+		surface?: 'primary' | 'secondary'
+		selected?: boolean
+		/** Not deployed yet: dashed edge. */
+		draft?: boolean
+		/** Feedback states, which recolor the whole card. `error` is a misconfigured
+		 * node, styled like a failed flow step. */
+		tone?: 'danger' | 'error' | 'success' | 'running'
+		/** Makes the whole card a button. */
+		onclick?: (e: MouseEvent) => void
+		/** Between the icon and the text: a live status the eye should find first. */
+		leading?: Snippet
+		trailing?: Snippet
+		/** Defaults to `NODE.width`. */
+		width?: number
+		/** A line under the title, in the text column. */
+		subtitle?: Snippet
+		/** A tab on the card's top edge. Only on a card without `onclick`, since it
+		 * may hold buttons of its own. */
+		header?: Snippet
+		/** The header's script is selected: its edge takes the selected colour. */
+		headerSelected?: boolean
+		/** The header's script has an error: its edge goes red. */
+		headerTone?: 'error'
+	}
+
+	let {
+		icon,
+		kindLabel,
+		title,
+		tooltip,
+		surface = 'secondary',
+		selected = false,
+		draft = false,
+		tone,
+		onclick,
+		leading,
+		trailing,
+		subtitle,
+		header,
+		headerSelected = false,
+		headerTone,
+		width = NODE.width
+	}: Props = $props()
+
+	const cardClass = $derived(
+		twMerge(
+			'flex items-center w-full text-left font-normal rounded-md drop-shadow-sm overflow-hidden border transition-colors',
+			surface === 'primary' ? 'bg-surface' : 'bg-surface-secondary',
+			'border-gray-400 dark:border-gray-600 hover:border-gray-500 dark:hover:border-gray-500',
+			// Like a flow step: a card with a background needs no edge, only its shadow,
+			// until one of the states below draws one.
+			surface === 'primary' &&
+				!draft &&
+				!selected &&
+				!tone &&
+				'border-transparent dark:border-transparent hover:border-transparent dark:hover:border-transparent',
+			draft && 'border-dashed border-gray-400 dark:border-gray-500',
+			// Like a selected flow step: the fill and the edge colour change, the edge's
+			// width and dashes stay.
+			// Each dark: variant too: the base edge sets its own dark colour, which a plain
+			// border class does not override.
+			selected &&
+				'bg-surface-accent-selected border-border-selected dark:border-border-selected hover:border-border-selected dark:hover:border-border-selected',
+			tone === 'danger' &&
+				'bg-red-50 dark:bg-red-900/30 border-dashed border-red-400 dark:border-red-500 hover:bg-red-100 dark:hover:bg-red-900/40',
+			tone === 'error' &&
+				(selected
+					? 'bg-red-200 dark:bg-red-600 border-red-500 dark:border-red-500 hover:border-red-500 dark:hover:border-red-500'
+					: 'bg-red-100 dark:bg-red-700 border-transparent dark:border-transparent hover:border-transparent dark:hover:border-transparent'),
+			tone === 'success' &&
+				'bg-green-50 dark:bg-green-900/30 border-green-500 dark:border-green-600',
+			tone === 'running' &&
+				'bg-amber-50 dark:bg-amber-900/30 border-amber-400 dark:border-amber-600 animate-pulse'
+		)
+	)
+	const minHeight = $derived(PIPELINE_NODE_HEIGHT + (subtitle ? PIPELINE_NODE_EXTRA_ROW : 0))
+	const toneText = $derived(
+		tone === 'danger'
+			? 'text-red-700 dark:text-red-400'
+			: tone === 'error'
+				? 'text-red-700 dark:text-red-200'
+			: tone === 'success'
+				? 'text-green-700 dark:text-green-400'
+				: undefined
+	)
+</script>
+
+{#snippet body()}
+	<span class="shrink-0 ml-3 mr-2.5 flex items-center">{@render icon()}</span>
+	{@render leading?.()}
+	<span class="flex flex-col min-w-0 flex-1 pr-1 py-1 leading-tight">
+		<span class={twMerge('text-2xs truncate text-secondary', toneText)}>{kindLabel}</span>
+		<span class={twMerge('text-xs truncate text-emphasis', selected && 'text-accent', toneText)}
+			>{title}</span
+		>
+		{#if subtitle}
+			<span class="flex items-center min-w-0 mt-1">{@render subtitle()}</span>
+		{/if}
+	</span>
+	{#if trailing}
+		<span class="flex items-center shrink-0 pr-2">{@render trailing()}</span>
+	{/if}
+{/snippet}
+
+{#if onclick}
+	<button
+		type="button"
+		{onclick}
+		class={cardClass}
+		style="width: {width}px; min-height: {minHeight}px;"
+		title={tooltip}
+	>
+		{@render body()}
+	</button>
+{:else if header}
+	<!-- The header is a tab on the card's top edge, inset from its sides. -->
+	<div class="flex flex-col" style="width: {width}px;">
+		<div
+			class={twMerge(
+				'mx-2 flex items-stretch min-w-0 rounded-t-md overflow-hidden bg-surface border border-b-0 border-gray-200 dark:border-gray-700',
+				// Like an errored card: red, and a stronger red when selected.
+				headerTone === 'error'
+					? headerSelected
+						? 'border-red-500 dark:border-red-500'
+						: 'border-red-300 dark:border-red-600'
+					: headerSelected && 'border-border-selected dark:border-border-selected'
+			)}
+			style="height: {PIPELINE_NODE_HEADER}px;"
+		>
+			{@render header()}
+		</div>
+		<div
+			class={twMerge(cardClass, !selected && !tone && 'bg-surface-tertiary')}
+			style="min-height: {minHeight + PIPELINE_NODE_HEADER_CARD_PAD}px; padding-block: {PIPELINE_NODE_HEADER_CARD_PAD /
+				2}px;"
+			title={tooltip}
+		>
+			{@render body()}
+		</div>
+	</div>
+{:else}
+	<div
+		class={cardClass}
+		style="width: {width}px; min-height: {minHeight}px;"
+		title={tooltip}
+	>
+		{@render body()}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
index 2450595b6d..8a060e0b2c 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import type { AssetKind, Script } from '$lib/gen'
-	import { CalendarClock, Loader2, Play, Upload, Zap } from 'lucide-svelte'
+	import { CalendarClock, Code2, Loader2, Play, Upload, Zap } from 'lucide-svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import HighlightCode from '$lib/components/HighlightCode.svelte'
 	import PipelineRunForm from './PipelineRunForm.svelte'
@@ -44,6 +44,12 @@
 		// "green / ready" state and seeds the whole-pipeline run. `isValid` is the
 		// full-schema validity (all required fields, not just the S3 file).
 		onArgsChange?: (path: string, args: Record<string, any>, isValid: boolean) => void
+		// Just the run form and the runs, without the source: what a data-upload
+		// click asks for. `onShowScript` switches to the script itself.
+		inputsOnly?: boolean
+		onShowScript?: () => void
+		// `onRun` previews a draft's own content, so a draft can run too.
+		runsDrafts?: boolean
 	}
 
 	let {
@@ -57,8 +63,12 @@
 		runsPendingJobId,
 		onRunCompleted,
 		initialArgs,
-		onArgsChange
+		onArgsChange,
+		inputsOnly = false,
+		onShowScript,
+		runsDrafts = false
 	}: Props = $props()
+	let runBlockedByDraft = $derived(isDraft && !runsDrafts)
 
 	// Seed once from the persisted args (see initialArgs). Cloned so the run
 	// form mutates its own copy, not the page's stored snapshot.
@@ -139,7 +149,7 @@
 </script>
 
 <div class="flex flex-col h-full">
-	{#if isDraft}
+	{#if runBlockedByDraft}
 		<div
 			class="shrink-0 flex items-center gap-2 px-3 py-1.5 text-2xs bg-amber-50 dark:bg-amber-900/30 border-b border-amber-200 dark:border-amber-900/60 text-amber-700 dark:text-amber-400"
 		>
@@ -168,13 +178,24 @@
 							{/if}
 						</span>
 						<div class="flex items-center gap-1.5">
+							{#if inputsOnly && onShowScript}
+								<Button
+									variant="subtle"
+									unifiedSize="sm"
+									startIcon={{ icon: Code2 }}
+									onclick={onShowScript}
+									title="Show the script instead of its inputs"
+								>
+									Open script
+								</Button>
+							{/if}
 							{#if hasCascade}
 								<Button
 									variant="accent-secondary"
 									unifiedSize="sm"
 									startIcon={{ icon: running ? Loader2 : Zap }}
 									onclick={() => run(true)}
-									disabled={isDraft || running || !runValid}
+									disabled={runBlockedByDraft || running || !runValid}
 									title={`Run this script with these inputs, then run its ${downstreamCount} downstream pipeline script${downstreamCount === 1 ? '' : 's'} in order`}
 								>
 									Run + downstream
@@ -185,8 +206,8 @@
 								unifiedSize="sm"
 								startIcon={{ icon: running ? Loader2 : Play }}
 								onclick={() => run(false)}
-								disabled={isDraft || running || !runValid || !onRun}
-								title={isDraft
+								disabled={runBlockedByDraft || running || !runValid || !onRun}
+								title={runBlockedByDraft
 									? 'Deploy this draft to run it for real'
 									: hasCascade
 										? 'Run just this step — downstream scripts are not triggered'
@@ -210,9 +231,11 @@
 						{/key}
 					{/if}
 				</div>
-				<div class="flex-1 min-h-0 overflow-auto text-xs p-3">
-					<HighlightCode code={script.content ?? ''} language={script.language} />
-				</div>
+				{#if !inputsOnly}
+					<div class="flex-1 min-h-0 overflow-auto text-xs p-3">
+						<HighlightCode code={script.content ?? ''} language={script.language} />
+					</div>
+				{/if}
 			</div>
 		</Pane>
 		<Pane size={45} minSize={20}>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineSetupSignpost.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineSetupSignpost.svelte
index 751ecbbdc8..0970708cb8 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineSetupSignpost.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineSetupSignpost.svelte
@@ -3,6 +3,8 @@
 	import { WorkspaceService } from '$lib/gen'
 	import { base } from '$lib/base'
 	import { CircleCheck, CircleAlert, Database, HardDrive, ArrowRight } from 'lucide-svelte'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import { Button } from '$lib/components/common'
 
 	interface Props {
 		workspace: string
@@ -73,48 +75,43 @@
 </script>
 
 {#if show}
-	<div
-		class="flex flex-col gap-3 rounded-lg border border-amber-300 dark:border-amber-900/60 bg-amber-50 dark:bg-amber-950/30 p-4"
-	>
-		<div class="flex items-start gap-2">
-			<CircleAlert size={18} class="text-amber-600 dark:text-amber-400 mt-0.5 shrink-0" />
-			<div class="flex flex-col gap-0.5">
-				<h3 class="text-sm font-semibold text-emphasis">Finish setting up pipelines</h3>
-				<p class="text-xs text-tertiary">
-					Pipelines materialize data into DuckLake tables backed by object storage. Configure the
-					following before your first pipeline can run.
-				</p>
-			</div>
+	<Alert type="warning" title="Finish setting up pipelines" hideIcon>
+		<div class="flex flex-col gap-3">
+			<p>
+				Pipelines materialize data into DuckLake tables backed by object storage. Configure the
+				following before your first pipeline can run.
+			</p>
+			<ul class="flex flex-col gap-2">
+				{#each steps as step (step.title)}
+					{@const Icon = step.icon}
+					<li class="flex items-center gap-3 rounded-md border bg-surface-tertiary px-3 py-2">
+						{#if step.done === true}
+							<CircleCheck size={16} class="text-green-600 dark:text-green-400 shrink-0" />
+						{:else if step.done === false}
+							<CircleAlert size={16} class="text-yellow-600 dark:text-yellow-400 shrink-0" />
+						{:else}
+							<Icon size={16} class="text-secondary shrink-0" />
+						{/if}
+						<div class="flex flex-col min-w-0 flex-1">
+							<span class="text-xs font-semibold text-emphasis">{step.title}</span>
+							<span class="text-2xs text-secondary">{step.description}</span>
+						</div>
+						{#if step.done !== true}
+							<Button
+								variant="default"
+								unifiedSize="sm"
+								href={step.href}
+								endIcon={{ icon: ArrowRight }}
+								wrapperClasses="shrink-0"
+							>
+								{step.cta}
+							</Button>
+						{:else}
+							<span class="shrink-0 text-2xs text-green-700 dark:text-green-400">Configured</span>
+						{/if}
+					</li>
+				{/each}
+			</ul>
 		</div>
-
-		<ul class="flex flex-col gap-2">
-			{#each steps as step (step.title)}
-				{@const Icon = step.icon}
-				<li class="flex items-center gap-3 rounded-md border bg-surface px-3 py-2">
-					{#if step.done === true}
-						<CircleCheck size={16} class="text-green-600 dark:text-green-400 shrink-0" />
-					{:else if step.done === false}
-						<CircleAlert size={16} class="text-amber-600 dark:text-amber-400 shrink-0" />
-					{:else}
-						<Icon size={16} class="text-tertiary shrink-0" />
-					{/if}
-					<div class="flex flex-col min-w-0 flex-1">
-						<span class="text-xs font-semibold text-primary">{step.title}</span>
-						<span class="text-2xs text-tertiary">{step.description}</span>
-					</div>
-					{#if step.done !== true}
-						<a
-							href={step.href}
-							class="shrink-0 inline-flex items-center gap-1 text-xs text-blue-500 hover:underline whitespace-nowrap"
-						>
-							{step.cta}
-							<ArrowRight size={12} />
-						</a>
-					{:else}
-						<span class="shrink-0 text-2xs text-green-700 dark:text-green-400">Configured</span>
-					{/if}
-				</li>
-			{/each}
-		</ul>
-	</div>
+	</Alert>
 {/if}
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
index 4f97039a1c..d8d19845fa 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
@@ -1,18 +1,10 @@
 <script lang="ts">
 	import { sendUserToast } from '$lib/utils'
+	import { workspaceStore } from '$lib/stores'
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
-	import type { NativeTriggerKind } from './types'
-	import {
-		EmailTriggerService,
-		GcpTriggerService,
-		KafkaTriggerService,
-		MqttTriggerService,
-		AmqpTriggerService,
-		NatsTriggerService,
-		PostgresTriggerService,
-		ScheduleService,
-		SqsTriggerService
-	} from '$lib/gen'
+	import type { NativeTriggerKind, PipelineTriggerDraftKind } from './types'
+	import type { Schedule } from '$lib/gen'
+	import { deleteTriggerRow } from './pipelineTriggerDraftDeploy'
 	import KafkaTriggerEditor from '$lib/components/triggers/kafka/KafkaTriggerEditor.svelte'
 	import MqttTriggerEditor from '$lib/components/triggers/mqtt/MqttTriggerEditor.svelte'
 	import AmqpTriggerEditor from '$lib/components/triggers/amqp/AmqpTriggerEditor.svelte'
@@ -22,6 +14,10 @@
 	import GcpTriggerEditor from '$lib/components/triggers/gcp/GcpTriggerEditor.svelte'
 	import EmailTriggerEditor from '$lib/components/triggers/email/EmailTriggerEditor.svelte'
 	import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
+	import {
+		loadDefaultScheduleAdvanced,
+		scheduleAdvancedCfg
+	} from '$lib/components/triggers/schedules/ScheduleAdvancedOptions.svelte'
 	import WebhookEditor from '$lib/components/triggers/webhook/WebhookEditor.svelte'
 	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
@@ -110,6 +106,56 @@
 		}
 	}
 
+	/** The kind's full editor over a pipeline-local draft; Save hands the config back,
+	 * and the drawer stays open when `onSave` refuses it.
+	 * `saved` is the draft being edited (absent for a new one), applied over `defaults`. */
+	export function openTriggerDraft(
+		kind: PipelineTriggerDraftKind,
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSave: (cfg: Record<string, any>) => boolean
+	) {
+		switch (kind) {
+			case 'schedule': {
+				// A new draft starts from the workspace's default handlers, like a new
+				// schedule does; the drawer only applies them when it opens without one.
+				const open = (advanced: Record<string, any>) =>
+					scheduleEditor?.openDraft(
+						{
+							is_flow: false,
+							args: {},
+							...advanced,
+							...defaults,
+							...saved,
+							script_path: scriptPath
+						} as Schedule,
+						onSave
+					)
+				if (saved || !$workspaceStore) return open({})
+				return loadDefaultScheduleAdvanced($workspaceStore)
+					.then((a) => open(scheduleAdvancedCfg(a)))
+					.catch(() => open({}))
+			}
+			case 'kafka':
+				return kafkaEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'mqtt':
+				return mqttEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'amqp':
+				return amqpEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'nats':
+				return natsEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'postgres':
+				return postgresEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'sqs':
+				return sqsEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'gcp':
+				return gcpEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'email':
+				return emailEditor?.openDraft(scriptPath, defaults, saved, onSave)
+		}
+	}
+
 	// Open the webhook drawer (endpoint URLs + token flow). Caller owns the
 	// draft guard.
 	export function openWebhook(scriptPath: string) {
@@ -133,37 +179,7 @@
 		const { kind, path: triggerPath } = triggerDeleteTarget
 		triggerDeleteLoading = true
 		try {
-			switch (kind) {
-				case 'schedule':
-					await ScheduleService.deleteSchedule({ workspace, path: triggerPath })
-					break
-				case 'kafka':
-					await KafkaTriggerService.deleteKafkaTrigger({ workspace, path: triggerPath })
-					break
-				case 'mqtt':
-					await MqttTriggerService.deleteMqttTrigger({ workspace, path: triggerPath })
-					break
-				case 'amqp':
-					await AmqpTriggerService.deleteAmqpTrigger({ workspace, path: triggerPath })
-					break
-				case 'nats':
-					await NatsTriggerService.deleteNatsTrigger({ workspace, path: triggerPath })
-					break
-				case 'postgres':
-					await PostgresTriggerService.deletePostgresTrigger({ workspace, path: triggerPath })
-					break
-				case 'sqs':
-					await SqsTriggerService.deleteSqsTrigger({ workspace, path: triggerPath })
-					break
-				case 'gcp':
-					await GcpTriggerService.deleteGcpTrigger({ workspace, path: triggerPath })
-					break
-				case 'email':
-					await EmailTriggerService.deleteEmailTrigger({ workspace, path: triggerPath })
-					break
-				default:
-					return
-			}
+			if (!(await deleteTriggerRow(kind, triggerPath, workspace))) return
 			sendUserToast(`Deleted ${kind} trigger "${triggerPath}"`)
 			triggerDeleteTarget = undefined
 			onUpdate()
diff --git a/frontend/src/lib/components/assets/AssetGraph/RunStateChip.svelte b/frontend/src/lib/components/assets/AssetGraph/RunStateChip.svelte
new file mode 100644
index 0000000000..21edf1df52
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/RunStateChip.svelte
@@ -0,0 +1,37 @@
+<script lang="ts">
+	import { twMerge } from 'tailwind-merge'
+	import { CheckCircle2, Loader2, XCircle } from 'lucide-svelte'
+	import type { RunnableRunState } from './activeRunnables.svelte'
+
+	let { runState: rs, class: className }: { runState: RunnableRunState; class?: string } = $props()
+</script>
+
+<div
+	class={twMerge(
+		'shrink-0 flex items-center gap-0.5 px-1 py-0.5 rounded-sm border',
+		rs.status === 'running'
+			? 'bg-blue-100 dark:bg-blue-900/40 text-blue-700 dark:text-blue-300 border-blue-300 dark:border-blue-700'
+			: rs.status === 'success'
+				? 'bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300 border-emerald-300 dark:border-emerald-700'
+				: 'bg-red-100 dark:bg-red-900/40 text-red-700 dark:text-red-300 border-red-300 dark:border-red-700',
+		className
+	)}
+	title={`${
+		rs.status === 'running'
+			? 'Running now'
+			: rs.status === 'success'
+				? 'Last run succeeded'
+				: 'Last run failed'
+	}${rs.runs > 0 ? ` — ran ${rs.runs}× this session` : ''}`}
+>
+	{#if rs.status === 'running'}
+		<Loader2 size={10} class="animate-spin" />
+	{:else if rs.status === 'success'}
+		<CheckCircle2 size={10} />
+	{:else}
+		<XCircle size={10} />
+	{/if}
+	{#if rs.runs > 0}
+		<span class="text-3xs leading-none tabular-nums">×{rs.runs}</span>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
index c4cb5ca998..5d28067982 100644
--- a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
@@ -1,10 +1,8 @@
 <script lang="ts">
 	import { Handle, Position } from '@xyflow/svelte'
 	import {
-		CheckCircle2,
 		ChevronDown,
 		Code2,
-		EllipsisVertical,
 		GitBranch,
 		Layers,
 		Loader2,
@@ -15,17 +13,20 @@
 		Target,
 		Timer,
 		Trash2,
-		XCircle,
 		Zap
 	} from 'lucide-svelte'
 	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
 	import { twMerge } from 'tailwind-merge'
-	import { preventDefault, stopPropagation } from 'svelte/legacy'
 	import type { GraphUsageKind } from './types'
 	import type { RunnableRunState } from './activeRunnables.svelte'
 	import { parseDurationSecs } from './parsePipelineAnnotations'
-	import { NODE } from '$lib/components/graph/util'
-	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import LanguageIcon from '$lib/components/common/languageIcons/LanguageIcon.svelte'
+	import PipelineNodeCard from './PipelineNodeCard.svelte'
+	import NodeActionsMenu from './NodeActionsMenu.svelte'
+	import NodeFixButton, { type NodeFix } from './NodeFixButton.svelte'
+	import NodeOnDot from './NodeOnDot.svelte'
+	import RunStateChip from './RunStateChip.svelte'
+	import type { ScriptLang } from '$lib/gen'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import type { Item } from '$lib/utils'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
@@ -35,8 +36,16 @@
 
 	interface Props {
 		data: {
+			/** What is wrong with the node, and how to fix it: shows the Fix pill. */
+			fix?: NodeFix
+			/** Starts dragging the top dot onto an asset to subscribe the script to it. */
+			onStartOnDrag?: (e: PointerEvent) => void
 			runnable_kind: GraphUsageKind
 			path: string
+			summary?: string
+			language?: ScriptLang
+			// Why the script is misconfigured, when it is: renders it red.
+			error?: string
 			in_pipeline?: boolean
 			partition_kind?: 'daily' | 'hourly' | 'weekly' | 'monthly' | 'dynamic'
 			freshness?: string
@@ -101,10 +110,11 @@
 	}
 	let { data, selected = false }: Props = $props()
 
-	// The icon alone conveys "script" vs "flow"; the uppercase kind label was
-	// visually noisy and redundant. Tooltip on hover surfaces the path in
-	// full when truncated.
 	let Icon = $derived(data.runnable_kind === 'flow' ? GitBranch : Code2)
+	let kindLabel = $derived(
+		data.runnable_kind === 'flow' ? 'Flow' : data.dbt ? 'dbt project' : 'Script'
+	)
+	// The title shows the summary when there is one, so the tooltip keeps the path.
 	let nodeTooltip = $derived(
 		data.unsaved
 			? `${data.path} (unsaved draft)`
@@ -114,7 +124,6 @@
 	)
 
 	let hover = $state(false)
-	let menuOpen = $state(false)
 	let running = $state(false)
 
 	// Amber "computing now" surface, gated so only the replay player lights it up.
@@ -214,131 +223,106 @@
 	<!--
 		Mirrors the flow editor's step styling (getNodeColorClasses): muted
 		surface-tertiary fill with a quiet gray border, accent only for the
-		selected state, dashes for unsaved drafts. The 2px dashed stroke is
-		necessary for the dash gaps to be readable; 1px disappears into the
-		fill.
+		selected state, dashes for unsaved drafts — 1px, like the trigger
+		nodes' dashed outline, so every draft node reads the same.
 	-->
-	<div
-		class={twMerge(
-			'flex items-center rounded-md drop-shadow-sm overflow-hidden border transition-colors',
-			'bg-surface border-gray-400 dark:border-gray-600 hover:border-gray-500 dark:hover:border-gray-500',
-			selected && 'bg-surface-accent-selected border-border-selected',
-			data.unsaved && 'border-2 border-dashed border-gray-400 dark:border-gray-500',
-			computingNow &&
-				'bg-amber-50 dark:bg-amber-900/30 border-amber-400 dark:border-amber-600 animate-pulse'
-		)}
-		style="width: {NODE.width}px; min-height: {NODE.height}px;"
-		title={nodeTooltip}
-	>
-		<Icon size={14} class={`shrink-0 ml-2 mr-2 ${selected ? 'text-accent' : 'text-secondary'}`} />
-		<span class="flex-1 min-w-0 pr-1 py-0.5 text-2xs font-mono text-emphasis truncate">
-			{data.path}
-		</span>
-		<!-- Annotation chips share one neutral treatment — the icon carries
-		     the meaning (colors are reserved for feedback, per the brand
-		     guidelines). Only the freshness chip (when it has a verdict)
-		     and the run-state chip below use semantic colors. -->
-		{#if data.partition_kind}
-			<div
-				class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
-				title={`// partitioned ${data.partition_kind}`}
-			>
-				<Layers size={10} />
-				<span class="text-3xs leading-none">{data.partition_kind}</span>
-			</div>
-		{/if}
-		<!-- Freshness is the one annotation chip that carries feedback (a
-		     fresh/stale verdict against real run history), so like the
-		     run-state chip it uses semantic colors: emerald = within window,
-		     amber = stale. Neutral when there's no verdict (drafts, bad
-		     window value). -->
-		{#if data.freshness}
-			<div
-				class={twMerge(
-					'shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm',
-					freshnessState === 'fresh'
-						? 'bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300'
-						: freshnessState === 'stale'
-							? 'bg-amber-100 dark:bg-amber-900/40 text-amber-700 dark:text-amber-300'
-							: 'bg-surface-secondary text-secondary'
-				)}
-				title={freshnessTooltip}
-			>
-				<Timer size={10} />
-				<span class="text-3xs leading-none">{data.freshness}</span>
-			</div>
-		{/if}
-		{#if data.tag}
-			<div
-				class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
-				title={`// tag ${data.tag}`}
-			>
-				<Tag size={10} />
-				<span class="text-3xs leading-none">{data.tag}</span>
-			</div>
-		{/if}
-		{#if data.retry}
-			{@const r = data.retry}
-			<div
-				class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
-				title={`// retry ${r.count}${r.delay ? ` ${r.delay}` : ''}`}
-			>
-				<RotateCw size={10} />
-				<span class="text-3xs leading-none">×{r.count}</span>
-			</div>
-		{/if}
-		{#if data.macros && data.macros.length > 0}
-			<div
-				class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
-				title={`// macros — defines ${data.macros.length} macro${data.macros.length > 1 ? 's' : ''}:\n${data.macros
-					.map((m) => `• ${m.name}(${m.params})${m.is_table ? ' → table' : ''}`)
-					.join('\n')}`}
-			>
-				<SquareFunction size={10} />
-				<span class="text-3xs leading-none">×{data.macros.length}</span>
-			</div>
-		{/if}
-		{#if data.dbt}
-			<div
-				class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-orange-100 dark:bg-orange-900/40 text-orange-700 dark:text-orange-300"
-				title={`dbt project — materializes ${data.dbt.model_count} model${data.dbt.model_count === 1 ? '' : 's'}`}
-			>
-				<DbtIcon width={10} height={10} />
-				<span class="text-3xs leading-none">×{data.dbt.model_count}</span>
-			</div>
-		{/if}
-		{#if data.runState}
-			{@const rs = data.runState}
-			<div
-				class={twMerge(
-					'shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm',
-					rs.status === 'running'
-						? 'bg-blue-100 dark:bg-blue-900/40 text-blue-700 dark:text-blue-300'
-						: rs.status === 'success'
-							? 'bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300'
-							: 'bg-red-100 dark:bg-red-900/40 text-red-700 dark:text-red-300'
-				)}
-				title={`${
-					rs.status === 'running'
-						? 'Running now'
-						: rs.status === 'success'
-							? 'Last run succeeded'
-							: 'Last run failed'
-				}${rs.runs > 0 ? ` — ran ${rs.runs}× this session` : ''}`}
-			>
-				{#if rs.status === 'running'}
-					<Loader2 size={10} class="animate-spin" />
-				{:else if rs.status === 'success'}
-					<CheckCircle2 size={10} />
+	<NodeActionsMenu items={menuItems} {hover}>
+		<PipelineNodeCard
+			surface="primary"
+			kindLabel="{kindLabel}{data.unsaved ? ' · draft' : ''}"
+			title={data.summary || data.path}
+			tooltip={data.error ? `${data.path}: ${data.error}` : nodeTooltip}
+			{selected}
+			draft={data.unsaved}
+			tone={computingNow ? 'running' : data.error ? 'error' : undefined}
+		>
+			{#snippet icon()}
+				{#if data.language && data.runnable_kind === 'script'}
+					<LanguageIcon lang={data.language} width={14} height={14} />
 				{:else}
-					<XCircle size={10} />
+					<Icon size={14} class={selected ? 'text-accent' : 'text-secondary'} />
 				{/if}
-				{#if rs.runs > 0}
-					<span class="text-3xs leading-none tabular-nums">×{rs.runs}</span>
+			{/snippet}
+			{#snippet trailing()}
+				<!-- Annotation chips share one neutral treatment — the icon carries
+			     the meaning (colors are reserved for feedback, per the brand
+			     guidelines). Only the freshness chip (when it has a verdict)
+			     and the run-state chip below use semantic colors. -->
+				{#if data.partition_kind}
+					<div
+						class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
+						title={`// partitioned ${data.partition_kind}`}
+					>
+						<Layers size={10} />
+						<span class="text-3xs leading-none">{data.partition_kind}</span>
+					</div>
 				{/if}
-			</div>
-		{/if}
-	</div>
+				<!-- Freshness is the one annotation chip that carries feedback (a
+			     fresh/stale verdict against real run history), so like the
+			     run-state chip it uses semantic colors: emerald = within window,
+			     amber = stale. Neutral when there's no verdict (drafts, bad
+			     window value). -->
+				{#if data.freshness}
+					<div
+						class={twMerge(
+							'shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm',
+							freshnessState === 'fresh'
+								? 'bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300'
+								: freshnessState === 'stale'
+									? 'bg-amber-100 dark:bg-amber-900/40 text-amber-700 dark:text-amber-300'
+									: 'bg-surface-secondary text-secondary'
+						)}
+						title={freshnessTooltip}
+					>
+						<Timer size={10} />
+						<span class="text-3xs leading-none">{data.freshness}</span>
+					</div>
+				{/if}
+				{#if data.tag}
+					<div
+						class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
+						title={`// tag ${data.tag}`}
+					>
+						<Tag size={10} />
+						<span class="text-3xs leading-none">{data.tag}</span>
+					</div>
+				{/if}
+				{#if data.retry}
+					{@const r = data.retry}
+					<div
+						class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
+						title={`// retry ${r.count}${r.delay ? ` ${r.delay}` : ''}`}
+					>
+						<RotateCw size={10} />
+						<span class="text-3xs leading-none">×{r.count}</span>
+					</div>
+				{/if}
+				{#if data.macros && data.macros.length > 0}
+					<div
+						class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
+						title={`// macros — defines ${data.macros.length} macro${data.macros.length > 1 ? 's' : ''}:\n${data.macros
+							.map((m) => `• ${m.name}(${m.params})${m.is_table ? ' → table' : ''}`)
+							.join('\n')}`}
+					>
+						<SquareFunction size={10} />
+						<span class="text-3xs leading-none">×{data.macros.length}</span>
+					</div>
+				{/if}
+				{#if data.dbt}
+					<div
+						class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-orange-100 dark:bg-orange-900/40 text-orange-700 dark:text-orange-300"
+						title={`dbt project — materializes ${data.dbt.model_count} model${data.dbt.model_count === 1 ? '' : 's'}`}
+					>
+						<DbtIcon width={10} height={10} />
+						<span class="text-3xs leading-none">×{data.dbt.model_count}</span>
+					</div>
+				{/if}
+				{#if data.runState}
+					<RunStateChip runState={data.runState} class="mr-1" />
+				{/if}
+			{/snippet}
+		</PipelineNodeCard>
+	</NodeActionsMenu>
 	{#if showRun}
 		<!-- Run button revealed on hover/select. Matches the placement, size,
 		     and behaviour of AssetNode's run button so both nodes feel
@@ -463,38 +447,12 @@
 			{/if}
 		</div>
 	{/if}
-
-	{#if menuItems.length > 0}
-		<!--
-			Hover-revealed action menu, top-right of the node. Mirrors the
-			FlowModuleSchemaItem pattern: position the trigger button just
-			outside the node frame, only render it on hover (or while the
-			menu is open) so the canvas isn't visually cluttered when idle.
-			The pointerdown stop+preventDefault keeps xyflow from selecting
-			the node when the user is reaching for the menu.
-		-->
-		<div class="absolute -top-2 -right-2 h-7 p-1 min-w-7" style="will-change: transform;">
-			<DropdownV2
-				items={menuItems}
-				placement="bottom-end"
-				bind:open={menuOpen}
-				fixedHeight={false}
-				usePointerDownOutside
-			>
-				{#snippet buttonReplacement()}
-					<button
-						class={twMerge(
-							'center-center p-1 text-secondary shadow-sm bg-surface duration-0 hover:bg-surface-tertiary',
-							hover || menuOpen ? 'block' : '!hidden',
-							'shadow-md rounded-md'
-						)}
-						onpointerdown={stopPropagation(preventDefault(() => {}))}
-						title="Actions"
-					>
-						<EllipsisVertical size={12} />
-					</button>
-				{/snippet}
-			</DropdownV2>
+	{#if data.onStartOnDrag}
+		<NodeOnDot onStart={data.onStartOnDrag} visible={hover} />
+	{/if}
+	{#if data.fix}
+		<div class="absolute left-1/2 -bottom-3 -translate-x-1/2 z-10">
+			<NodeFixButton fix={data.fix} />
 		</div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte b/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte
index 0e279112cd..f678b3d272 100644
--- a/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte
@@ -24,46 +24,36 @@
 	type Presentation = {
 		icon: ComponentType
 		label: string
-		// Tailwind class fragments for bg + border + text accent.
-		bg: string
-		border: string
-		borderUnsaved: string
 		iconText: string
 	}
 
-	// One muted treatment for every source kind — colors are meaningful, not
+	// One muted icon color for every source kind — colors are meaningful, not
 	// decorative (brand guidelines), so the kind is carried by the icon and
-	// label while bg/border stay on the surface/gray scale like the flow
-	// editor's nodes. Red stays reserved for the missing-trigger state.
-	const MUTED = {
-		bg: 'bg-surface-secondary',
-		border: 'outline-gray-400 dark:outline-gray-600',
-		borderUnsaved: 'outline-dashed outline-gray-400 dark:outline-gray-500',
-		iconText: 'text-secondary'
-	}
+	// label. Red stays reserved for the missing-trigger state.
+	const MUTED = { iconText: 'text-secondary' }
 
 	export const TRIGGER_NODE_STYLE: Record<TriggerNodeKind, Presentation> = {
-		schedule: { icon: Clock, label: 'schedule', ...MUTED },
-		webhook: { icon: Webhook, label: 'webhook', ...MUTED },
-		email: { icon: Mail, label: 'email', ...MUTED },
-		kafka: { icon: Zap, label: 'kafka', ...MUTED },
-		mqtt: { icon: Radio, label: 'mqtt', ...MUTED },
-		amqp: { icon: Radio, label: 'amqp', ...MUTED },
-		nats: { icon: MessageSquare, label: 'nats', ...MUTED },
-		postgres: { icon: Database, label: 'postgres', ...MUTED },
-		sqs: { icon: Send, label: 'sqs', ...MUTED },
-		gcp: { icon: CloudCog, label: 'gcp', ...MUTED },
-		data_upload: { icon: Upload, label: 'data upload', ...MUTED }
+		schedule: { icon: Clock, label: 'Schedule', ...MUTED },
+		webhook: { icon: Webhook, label: 'Webhook', ...MUTED },
+		email: { icon: Mail, label: 'Email', ...MUTED },
+		kafka: { icon: Zap, label: 'Kafka', ...MUTED },
+		mqtt: { icon: Radio, label: 'MQTT', ...MUTED },
+		amqp: { icon: Radio, label: 'AMQP', ...MUTED },
+		nats: { icon: MessageSquare, label: 'NATS', ...MUTED },
+		postgres: { icon: Database, label: 'Postgres', ...MUTED },
+		sqs: { icon: Send, label: 'SQS', ...MUTED },
+		gcp: { icon: CloudCog, label: 'GCP Pub/Sub', ...MUTED },
+		data_upload: { icon: Upload, label: 'Data upload', ...MUTED }
 	}
 </script>
 
 <script lang="ts">
 	import { Handle, Position } from '@xyflow/svelte'
-	import { NODE } from '$lib/components/graph/util'
-	import { twMerge } from 'tailwind-merge'
-	import { AlertTriangle, CheckCircle2, EllipsisVertical, Target, Trash2 } from 'lucide-svelte'
-	import DropdownV2 from '$lib/components/DropdownV2.svelte'
-	import { stopPropagation, preventDefault } from 'svelte/legacy'
+	import PipelineNodeCard from './PipelineNodeCard.svelte'
+	import NodeActionsMenu from './NodeActionsMenu.svelte'
+	import NodeFixButton, { type NodeFix } from './NodeFixButton.svelte'
+	import { describeSchedule } from '$lib/utils/describeCron'
+	import { AlertTriangle, CheckCircle2, Target, Trash2 } from 'lucide-svelte'
 	import type { Item } from '$lib/utils'
 
 	interface Props {
@@ -74,16 +64,22 @@
 		// owning script is in `runnable_path` (used by the title and the
 		// "+ Create trigger" drawer hook passed by the page).
 		data: {
+			/** What is wrong with the node, and how to fix it: shows the Fix pill. */
+			fix?: NodeFix
 			kind: TriggerNodeKind
 			ref: string
 			unsaved?: boolean
 			missing?: boolean
+			// A pipeline-local schedule draft: `ref` is the path it deploys to.
+			// Edit/delete go through the same callbacks, which the page routes
+			// to the draft instead of a trigger row.
+			draft?: boolean
+			// The cron, for a schedule: the node names its cadence instead of "Schedule".
+			schedule?: string
+			timezone?: string
+			// Shown as the title over the trigger's path, when the trigger has one.
+			summary?: string
 			runnable_path?: string
-			// True iff the target script is still a draft (no DB row yet).
-			// Drives the "(after draft save)" hint on the missing
-			// placeholder, since the page-level handler refuses to open the
-			// create drawer until the script is deployed.
-			runnable_unsaved?: boolean
 			// Page-supplied dispatcher that opens the matching native
 			// trigger drawer with `script_path` pre-filled. When absent
 			// (e.g. schedule, or a kind without an editor) the placeholder is
@@ -128,7 +124,6 @@
 	let { data }: Props = $props()
 
 	let hover = $state(false)
-	let menuOpen = $state(false)
 
 	let style = $derived(TRIGGER_NODE_STYLE[data.kind])
 	// Webhooks are never genuinely "missing" — every deployed runnable has an
@@ -143,7 +138,7 @@
 	let Icon = $derived(displayMissing ? AlertTriangle : style.icon)
 	let missingTitle = $derived(
 		displayMissing
-			? `Missing ${style.label} trigger: ${data.runnable_path ?? ''} declares \`// on ${style.label}\` but no ${style.label} trigger targets it. Click to create one, or remove the annotation.`
+			? `Missing ${style.label} trigger: ${data.runnable_path ?? ''} declares \`// on ${data.kind}\` but no ${style.label} trigger targets it. Click to create one, or remove the annotation.`
 			: undefined
 	)
 	// Webhook gets a drawer (URLs + webhook-specific token creation) rather
@@ -200,7 +195,7 @@
 		...(canDelete
 			? [
 					{
-						displayName: 'Delete…',
+						displayName: data.draft ? 'Discard draft' : 'Delete…',
 						icon: Trash2,
 						type: 'delete' as const,
 						action: () => {
@@ -212,6 +207,75 @@
 			: [])
 	])
 
+	// A schedule names its cadence ("Every day at 4:00", or the cron itself
+	// when it has no plain reading); every other kind names its kind.
+	let kindName = $derived(
+		data.kind === 'schedule' && data.schedule
+			? (describeSchedule(data.schedule, data.timezone) ?? `Schedule (${data.schedule})`)
+			: style.label
+	)
+
+	// One card for every state: which label, title and click the node gets.
+	let card = $derived.by(
+		(): {
+			kindLabel: string
+			title: string
+			tooltip?: string
+			draft: boolean
+			tone?: 'danger' | 'success'
+			onclick?: () => void
+		} => {
+			const unsaved = !!data.unsaved
+			if (canCreate)
+				return {
+					kindLabel: `${style.label} · missing`,
+					title: 'Click to create',
+					tooltip: missingTitle,
+					draft: false,
+					tone: 'danger',
+					onclick: handleMissingClick
+				}
+			if (canEdit)
+				return {
+					kindLabel: `${kindName}${data.draft ? ' · draft' : unsaved ? ' · unsaved' : ''}`,
+					title: data.summary || data.ref,
+					tooltip: data.draft
+						? `Draft ${style.label}: ${data.ref} — created when you save the pipeline. Click to edit.`
+						: `Edit ${style.label} trigger: ${data.ref}`,
+					draft: unsaved,
+					onclick: handleEditClick
+				}
+			if (canOpenWebhook)
+				return {
+					kindLabel: style.label,
+					title: 'URLs & token',
+					tooltip: `Webhook endpoint for ${data.runnable_path ?? ''} — click to view URLs and create a token`,
+					draft: unsaved,
+					onclick: handleWebhookClick
+				}
+			if (canOpenDataUpload)
+				return {
+					kindLabel: `${style.label}${dataUploadReady ? ' · ready' : ''}`,
+					title: dataUploadReady ? 'File staged' : 'Upload & run',
+					tooltip: dataUploadReady
+						? `Data upload for ${data.runnable_path ?? ''} — a file is staged; the pipeline is ready to run. Click to change it.`
+						: `Data upload for ${data.runnable_path ?? ''} — click to open the run form and upload a file`,
+					draft: !dataUploadReady && unsaved,
+					tone: dataUploadReady ? 'success' : undefined,
+					onclick: handleDataUploadClick
+				}
+			return {
+				kindLabel: `${displayMissing ? style.label : kindName}${displayMissing ? ' · missing' : unsaved ? ' · unsaved' : ''}`,
+				title: displayMissing ? 'no trigger row' : data.summary || data.ref,
+				tooltip:
+					missingTitle ??
+					(unsaved ? `Unsaved ${style.label}: ${data.ref}` : `${style.label}: ${data.ref}`),
+				draft: unsaved && !displayMissing,
+				tone: displayMissing ? 'danger' : undefined
+			}
+		}
+	)
+
 	function handleMissingClick() {
 		if (!canCreate || !data.runnable_path || !data.onCreateMissingTrigger) return
 		data.onCreateMissingTrigger(data.kind as NativeTriggerKind, data.runnable_path)
@@ -235,195 +299,33 @@
 
 <!-- svelte-ignore a11y_no_static_element_interactions -->
 <div class="relative" onmouseenter={() => (hover = true)} onmouseleave={() => (hover = false)}>
-	{#if canCreate}
-		<!-- Same affordance as the asset's downstream + button: render the
-		     whole node as a button so the cursor + hover + click is obvious
-		     without depending on svelte-flow's wrapper-level handlers. -->
-		<button
-			type="button"
-			onclick={handleMissingClick}
-			class={twMerge(
-				'flex items-center rounded-md drop-shadow-sm overflow-hidden outline outline-1 w-full text-left',
-				'bg-red-50 dark:bg-red-900/30 outline-dashed outline-red-400 dark:outline-red-500',
-				'hover:bg-red-100 dark:hover:bg-red-900/40 transition-colors'
-			)}
-			style="width: {NODE.width}px; min-height: {NODE.height}px;"
-			title={missingTitle}
+	<NodeActionsMenu items={menuItems} {hover}>
+		<PipelineNodeCard
+			kindLabel={card.kindLabel}
+			title={card.title}
+			tooltip={card.tooltip}
+			draft={card.draft}
+			tone={card.tone}
+			onclick={card.onclick}
 		>
-			<Icon size={14} class="shrink-0 ml-2 mr-2 text-red-600 dark:text-red-400" />
-			<div class="flex flex-col min-w-0 flex-1 pr-2 py-0.5 leading-tight">
-				<span class="text-3xs uppercase tracking-wide truncate text-red-700 dark:text-red-400">
-					{style.label} · missing
-				</span>
-				<span class="text-2xs font-mono truncate text-red-700 dark:text-red-400">
-					{data.runnable_unsaved ? 'Click to create (after draft save)' : 'Click to create'}
-				</span>
-			</div>
-		</button>
-	{:else if canEdit}
-		<!-- Mirrors the missing-trigger pattern: render the whole node as a
-		     button so clicks open the editor drawer reliably (don't rely on
-		     svelte-flow's onnodeclick wiring). -->
-		<button
-			type="button"
-			onclick={handleEditClick}
-			class={twMerge(
-				'flex items-center rounded-md drop-shadow-sm overflow-hidden outline outline-1 w-full text-left',
-				style.bg,
-				data.unsaved ? `opacity-80 ${style.borderUnsaved}` : style.border,
-				'hover:brightness-95 dark:hover:brightness-110 transition-[filter]'
-			)}
-			style="width: {NODE.width}px; min-height: {NODE.height}px;"
-			title={`Edit ${style.label} trigger: ${data.ref}`}
-		>
-			<Icon size={14} class={`shrink-0 ml-2 mr-2 ${style.iconText}`} />
-			<div class="flex flex-col min-w-0 flex-1 pr-2 py-0.5 leading-tight">
-				<span class="text-3xs uppercase tracking-wide truncate text-tertiary">
-					{style.label}{data.unsaved ? ' · unsaved' : ''}
-				</span>
-				<span class="text-2xs font-mono truncate text-emphasis">
-					{data.ref}
-				</span>
-			</div>
-		</button>
-	{:else if canOpenWebhook}
-		<!-- Webhook endpoint: implicit (no trigger row), so the node opens a
-		     drawer with the URLs + webhook-specific token creation instead of
-		     an editor. Styled like an attached trigger, never the red
-		     "missing" state. -->
-		<button
-			type="button"
-			onclick={handleWebhookClick}
-			class={twMerge(
-				'flex items-center rounded-md drop-shadow-sm overflow-hidden outline outline-1 w-full text-left',
-				style.bg,
-				data.unsaved ? `opacity-80 ${style.borderUnsaved}` : style.border,
-				'hover:brightness-95 dark:hover:brightness-110 transition-[filter]'
-			)}
-			style="width: {NODE.width}px; min-height: {NODE.height}px;"
-			title={`Webhook endpoint for ${data.runnable_path ?? ''} — click to view URLs and create a token`}
-		>
-			<Icon size={14} class={`shrink-0 ml-2 mr-2 ${style.iconText}`} />
-			<div class="flex flex-col min-w-0 flex-1 pr-2 py-0.5 leading-tight">
-				<span class="text-3xs uppercase tracking-wide truncate text-tertiary">
-					{style.label}
-				</span>
-				<span class="text-2xs font-mono truncate text-emphasis"> URLs & token </span>
-			</div>
-		</button>
-	{:else if canOpenDataUpload}
-		<!-- Data upload: UI-first entry point (no trigger row). Clicking the
-		     node opens the target script's run form, where the auto-generated
-		     S3 picker lets the user upload a file and run the pipeline. Goes
-		     green once a file is staged (ready), so "Run pipeline" can proceed;
-		     until then it stays neutral with an "upload a file" prompt. Never
-		     the red "missing" state. -->
-		<button
-			type="button"
-			onclick={handleDataUploadClick}
-			class={twMerge(
-				'flex items-center rounded-md drop-shadow-sm overflow-hidden outline outline-1 w-full text-left',
-				dataUploadReady
-					? 'bg-green-50 dark:bg-green-900/30 outline-green-500 dark:outline-green-600'
-					: style.bg,
-				dataUploadReady ? '' : data.unsaved ? `opacity-80 ${style.borderUnsaved}` : style.border,
-				'hover:brightness-95 dark:hover:brightness-110 transition-[filter]'
-			)}
-			style="width: {NODE.width}px; min-height: {NODE.height}px;"
-			title={dataUploadReady
-				? `Data upload for ${data.runnable_path ?? ''} — a file is staged; the pipeline is ready to run. Click to change it.`
-				: `Data upload for ${data.runnable_path ?? ''} — click to open the run form and upload a file`}
-		>
-			<DataUploadIcon
-				size={14}
-				class={`shrink-0 ml-2 mr-2 ${dataUploadReady ? 'text-green-600 dark:text-green-400' : style.iconText}`}
-			/>
-			<div class="flex flex-col min-w-0 flex-1 pr-2 py-0.5 leading-tight">
-				<span
-					class={twMerge(
-						'text-3xs uppercase tracking-wide truncate',
-						dataUploadReady ? 'text-green-700 dark:text-green-400' : 'text-tertiary'
-					)}
-				>
-					{style.label}{dataUploadReady ? ' · ready' : ''}
-				</span>
-				<span
-					class={twMerge(
-						'text-2xs font-mono truncate',
-						dataUploadReady ? 'text-green-700 dark:text-green-400' : 'text-emphasis'
-					)}
-				>
-					{dataUploadReady ? 'File staged' : 'Upload & run'}
-				</span>
-			</div>
-		</button>
-	{:else}
-		<div
-			class={twMerge(
-				'flex items-center rounded-md drop-shadow-sm overflow-hidden outline outline-1',
-				displayMissing
-					? 'bg-red-50 dark:bg-red-900/30 outline-dashed outline-red-400 dark:outline-red-500'
-					: style.bg,
-				displayMissing ? '' : data.unsaved ? `opacity-80 ${style.borderUnsaved}` : style.border
-			)}
-			style="width: {NODE.width}px; min-height: {NODE.height}px;"
-			title={missingTitle ??
-				(data.unsaved ? `Unsaved ${style.label}: ${data.ref}` : `${style.label}: ${data.ref}`)}
-		>
-			<Icon
-				size={14}
-				class={`shrink-0 ml-2 mr-2 ${displayMissing ? 'text-red-600 dark:text-red-400' : style.iconText}`}
-			/>
-			<div class="flex flex-col min-w-0 flex-1 pr-2 py-0.5 leading-tight">
-				<span
-					class={twMerge(
-						'text-3xs uppercase tracking-wide truncate',
-						displayMissing ? 'text-red-700 dark:text-red-400' : 'text-tertiary'
-					)}
-				>
-					{style.label}{displayMissing ? ' · missing' : data.unsaved ? ' · unsaved' : ''}
-				</span>
-				<span
-					class={twMerge(
-						'text-2xs font-mono truncate',
-						displayMissing ? 'text-red-700 dark:text-red-400' : 'text-emphasis'
-					)}
-				>
-					{displayMissing ? 'no trigger row' : data.ref}
-				</span>
-			</div>
-		</div>
-	{/if}
-
-	{#if menuItems.length > 0}
-		<!-- Hover-revealed kebab menu (Delete only for now). Mirrors the
-		     RunnableNode pattern: positioned just outside the top-right of
-		     the node, rendered only on hover or while the menu is open so
-		     the canvas stays clean at rest. `pointerdown` is stopped so
-		     svelte-flow doesn't kick off node selection / drag when the
-		     user reaches for the menu. -->
-		<div class="absolute -top-2 -right-2 h-7 p-1 min-w-7" style="will-change: transform;">
-			<DropdownV2
-				items={menuItems}
-				placement="bottom-end"
-				bind:open={menuOpen}
-				fixedHeight={false}
-				usePointerDownOutside
-			>
-				{#snippet buttonReplacement()}
-					<button
-						class={twMerge(
-							'center-center p-1 text-secondary shadow-sm bg-surface duration-0 hover:bg-surface-tertiary',
-							hover || menuOpen ? 'block' : '!hidden',
-							'shadow-md rounded-md'
-						)}
-						onpointerdown={stopPropagation(preventDefault(() => {}))}
-						title="Actions"
-					>
-						<EllipsisVertical size={12} />
-					</button>
-				{/snippet}
-			</DropdownV2>
+			{#snippet icon()}
+				{#if canOpenDataUpload}
+					<DataUploadIcon
+						size={14}
+						class={dataUploadReady ? 'text-green-600 dark:text-green-400' : style.iconText}
+					/>
+				{:else}
+					<Icon
+						size={14}
+						class={displayMissing || canCreate ? 'text-red-600 dark:text-red-400' : style.iconText}
+					/>
+				{/if}
+			{/snippet}
+		</PipelineNodeCard>
+	</NodeActionsMenu>
+	{#if data.fix}
+		<div class="absolute left-1/2 -bottom-3 -translate-x-1/2 z-10">
+			<NodeFixButton fix={data.fix} />
 		</div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.test.ts b/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.test.ts
index 24e7d4c2da..073432e1a5 100644
--- a/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.test.ts
@@ -147,4 +147,18 @@ describe('layoutAssetGraph (tidy-tree with join breaks)', () => {
 			expect(pos.get(id)!.y).toBeGreaterThan(anchor.y)
 		}
 	})
+
+	it('packs narrow nodes by their own width', () => {
+		const pos = layoutAssetGraph({
+			nodes: [
+				{ ...n('p'), width: 100 },
+				{ ...n('l'), width: 100 },
+				{ ...n('r'), width: 180 }
+			],
+			edges: [e('p', 'l'), e('p', 'r')]
+		})
+		const gap = pos.get('r')!.x - 90 - (pos.get('l')!.x + 50)
+		expect(gap).toBe(NODE.gap.horizontal)
+		expect(pos.get('l')!.x).toBe(50)
+	})
 })
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.ts b/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.ts
index c9d7d60355..e1e1e1e7da 100644
--- a/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.ts
@@ -7,7 +7,15 @@ import { NODE } from '$lib/components/graph/util'
 // breathing room.
 const NODE_WIDTH = NODE.width
 const NODE_HEIGHT = NODE.height + 30
-const LAYER_GAP = NODE.gap.vertical
+/** Rendered height of a pipeline node: a kind label over a title. Fits inside
+ * the `NODE_HEIGHT` row the layout reserves. */
+export const PIPELINE_NODE_HEIGHT = 48
+// A step more than the flow editor's gap: the + on a node's bottom edge sits in it.
+const LAYER_GAP = NODE.gap.vertical + 16
+/** Height of the "Add data source" pill the anchor draws, and its gap to the
+ * graph: tighter than LAYER_GAP, since no edge runs through it. */
+const ANCHOR_HEIGHT = 32
+const ANCHOR_GAP = 40
 const SIBLING_GAP = NODE.gap.horizontal
 // Horizontal gutter between two disjoint subgraphs. Wider than the
 // within-subgraph sibling gap so visually-unrelated components (e.g. two
@@ -15,10 +23,16 @@ const SIBLING_GAP = NODE.gap.horizontal
 // into each other's columns — but only ~2×, so they don't drift far apart.
 const COMPONENT_GAP = SIBLING_GAP * 2
 
-const LAYER_H = NODE_HEIGHT + LAYER_GAP
+/** Extra height of an assets-only node: the trigger chip under its title. */
+export const PIPELINE_NODE_EXTRA_ROW = 20
+/** Height of the header strip naming an assets-only node's producing script. */
+export const PIPELINE_NODE_HEADER = 22
+/** Extra vertical padding of a card under a header, top plus bottom. */
+export const PIPELINE_NODE_HEADER_CARD_PAD = 12
 
 interface GraphInput {
-	nodes: Array<{ id: string; data: AssetGraphNodeData }>
+	/** `width` defaults to `NODE.width`. */
+	nodes: Array<{ id: string; data: AssetGraphNodeData; width?: number }>
 	edges: Array<{ source: string; target: string }>
 }
 
@@ -52,15 +66,18 @@ interface Band {
 // intersects theirs.
 //
 // y comes from longest-path layering (same top-down orientation as before:
-// producers above, assets in the middle, consumers below). Returns positions
-// (band centers) normalized so the component's min x,y = 0. Cyclic input is
-// handled by dropping feedback edges (see the Kahn step below).
+// producers above, assets in the middle, consumers below). Returns node
+// centers, normalized so the component's leftmost edge and top are at 0.
+// Cyclic input is handled by dropping feedback edges (see the Kahn step below).
 function layoutComponent(
 	nodes: GraphInput['nodes'],
-	edges: GraphInput['edges']
+	edges: GraphInput['edges'],
+	rowH: number
 ): Map<string, Positioned> {
+	const layerH = rowH + LAYER_GAP
 	const out = new Map<string, Positioned>()
 	const ids = new Set(nodes.map((n) => n.id))
+	const nodeW = new Map(nodes.map((n) => [n.id, n.width ?? NODE_WIDTH]))
 
 	const parents = new Map<string, string[]>()
 	const children = new Map<string, string[]>()
@@ -137,7 +154,7 @@ function layoutComponent(
 		const kids = treeChildren.get(id)!
 		const kidsW =
 			kids.reduce((acc, k) => acc + W.get(k)!, 0) + SIBLING_GAP * Math.max(0, kids.length - 1)
-		W.set(id, Math.max(NODE_WIDTH, kidsW))
+		W.set(id, Math.max(nodeW.get(id)!, kidsW))
 	}
 
 	// Vertical (pixel) extent of a subtree, for band collision checks.
@@ -152,14 +169,14 @@ function layoutComponent(
 			if (l > hi) hi = l
 			for (const k of treeChildren.get(cur)!) stack.push(k)
 		}
-		return { top: lo * LAYER_H, bottom: hi * LAYER_H + NODE_HEIGHT }
+		return { top: lo * layerH, bottom: hi * layerH + rowH }
 	}
 
 	// Recursive placement: node centered over its band, children packed
 	// side-by-side and centered within it.
 	function placeTree(id: string, left: number) {
 		const w = W.get(id)!
-		out.set(id, { x: left + w / 2, y: layer.get(id)! * LAYER_H })
+		out.set(id, { x: left + w / 2, y: layer.get(id)! * layerH })
 		const kids = treeChildren.get(id)!
 		if (kids.length === 0) return
 		const kidsW = kids.reduce((acc, k) => acc + W.get(k)!, 0) + SIBLING_GAP * (kids.length - 1)
@@ -211,11 +228,11 @@ function layoutComponent(
 		placeAndRecord(id, center - w / 2)
 	}
 
-	// Normalize so the component's min x,y = 0.
+	// Normalize so the component's leftmost edge and top are at 0.
 	let minX = Infinity
 	let minY = Infinity
-	for (const p of out.values()) {
-		if (p.x < minX) minX = p.x
+	for (const [id, p] of out) {
+		if (p.x - nodeW.get(id)! / 2 < minX) minX = p.x - nodeW.get(id)! / 2
 		if (p.y < minY) minY = p.y
 	}
 	if (isFinite(minX) && isFinite(minY)) {
@@ -243,7 +260,13 @@ function layoutComponent(
 //
 // Falls back to a stable grid if the component layout throws (defensive —
 // cycles are already absorbed by feedback-edge dropping in layoutComponent).
-export function layoutAssetGraph(graph: GraphInput, anchorId?: string): Map<string, Positioned> {
+export function layoutAssetGraph(
+	graph: GraphInput,
+	anchorId?: string,
+	extraRowHeight = 0
+): Map<string, Positioned> {
+	const rowH = NODE_HEIGHT + extraRowHeight
+	const layerH = rowH + LAYER_GAP
 	const byId = new Map<string, Positioned>()
 	if (graph.nodes.length === 0) return byId
 
@@ -297,19 +320,20 @@ export function layoutAssetGraph(graph: GraphInput, anchorId?: string): Map<stri
 		// 3. Lay out each component and pack side-by-side. xOffset advances by
 		// the laid-out width of each component (max node center + a node width,
 		// since positions are node centers) plus the gutter.
+		const widthOf = new Map(nodes.map((n) => [n.id, n.width ?? NODE_WIDTH]))
 		let xOffset = 0
 		for (let c = 0; c < nComp; c++) {
-			const positions = layoutComponent(compNodes[c], compEdges[c])
-			let maxX = 0
-			for (const p of positions.values()) if (p.x > maxX) maxX = p.x
+			const positions = layoutComponent(compNodes[c], compEdges[c], rowH)
+			let maxRight = 0
 			for (const [id, p] of positions) {
+				maxRight = Math.max(maxRight, p.x + widthOf.get(id)! / 2)
 				byId.set(id, { x: p.x + xOffset, y: p.y })
 			}
-			xOffset += maxX + NODE_WIDTH + COMPONENT_GAP
+			xOffset += maxRight + COMPONENT_GAP
 		}
 
 		// 4. Re-place the anchor centered horizontally over the whole packed
-		// graph, one layer above it; then renormalize so the anchor sits at the
+		// graph, just above it; then renormalize so the anchor sits at the
 		// top (y = 0), pushing the components down a layer to make room (mirrors
 		// the previous "anchor is the parent of every root" behaviour).
 		if (anchorId && graph.nodes.some((n) => n.id === anchorId)) {
@@ -324,7 +348,9 @@ export function layoutAssetGraph(graph: GraphInput, anchorId?: string): Map<stri
 					if (p.x > maxX) maxX = p.x
 					if (p.y < minY) minY = p.y
 				}
-				byId.set(anchorId, { x: (minX + maxX) / 2, y: minY - LAYER_H })
+				// One gap above the graph, sized to the pill rather than a full node row:
+				// a row tall enough for an assets-only card leaves it floating high.
+				byId.set(anchorId, { x: (minX + maxX) / 2, y: minY - ANCHOR_HEIGHT - ANCHOR_GAP })
 				let nMinY = Infinity
 				for (const p of byId.values()) if (p.y < nMinY) nMinY = p.y
 				for (const p of byId.values()) p.y -= nMinY
@@ -336,7 +362,7 @@ export function layoutAssetGraph(graph: GraphInput, anchorId?: string): Map<stri
 		graph.nodes.forEach((n, i) => {
 			byId.set(n.id, {
 				x: (i % cols) * (NODE_WIDTH + SIBLING_GAP),
-				y: Math.floor(i / cols) * LAYER_H
+				y: Math.floor(i / cols) * layerH
 			})
 		})
 		return byId
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetNodeWidth.ts b/frontend/src/lib/components/assets/AssetGraph/assetNodeWidth.ts
new file mode 100644
index 0000000000..176ecf7411
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/assetNodeWidth.ts
@@ -0,0 +1,66 @@
+import { NODE } from '$lib/components/graph/util'
+
+const MIN_WIDTH = 160
+
+let ctx: CanvasRenderingContext2D | null | undefined
+
+/** Rendered width of `text` at `rem` in the page font, or a rough guess without a DOM. */
+function textWidth(text: string, rem: number): number {
+	if (typeof document === 'undefined') return text.length * rem * 16 * 0.6
+	ctx ??= document.createElement('canvas').getContext('2d')
+	const root = parseFloat(getComputedStyle(document.documentElement).fontSize) || 16
+	if (!ctx) return text.length * rem * root * 0.6
+	const body = getComputedStyle(document.body)
+	ctx.font = `${rem * root}px ${body.fontFamily}`
+	const spacing = parseFloat(body.letterSpacing) || 0
+	return ctx.measureText(text).width + spacing * text.length
+}
+
+/**
+ * Width of an assets-only asset card, from the pieces `PipelineNodeCard` and
+ * `AssetNode` lay out: icon and the widest of kind / title / trigger chip, or the
+ * header naming the producing script, if wider. The numbers mirror their Tailwind spacing; change one
+ * and the other drifts. Clamped to the regular node width, past which the title
+ * truncates as usual.
+ */
+export function assetsOnlyNodeWidth(n: {
+	kind: string
+	title: string
+	chip: string
+	/** The chip leads with an icon (the folded-errors Fix chip). */
+	chipIcon?: boolean
+	/** The chip ends in the edit icon (an editable trigger). */
+	chipEdit?: boolean
+	/** The header tab: its text (a script's summary or path, "N scripts"), icon
+	 * count, and whether it ends in the menu chevron (else the edit icon) or has a "draft" mark;
+	 * undefined without a header. */
+	header?: { label: string; icons: number; chevron?: boolean; draft?: boolean }
+}): number {
+	const icon = 12 + 14 + 10
+	const text = Math.max(
+		textWidth(n.kind, 0.7),
+		textWidth(n.title, 0.75),
+		textWidth(n.chip, 0.65) + 12 + 2 + (n.chipIcon ? 14 : 0) + (n.chipEdit ? 4 + 9 : 0)
+	)
+	const body = Math.ceil(icon + text + 4 + 8 + 2 + 8)
+	// Header tab: mx-2 and a 1px border around px-2, then gap-1.5 between its
+	// items: the icons, the label, a "draft" mark, and the chevron or edit icon.
+	// The run chip is left out: it comes and goes with runs, and a width that
+	// followed it would re-lay the graph on a click; the label truncates instead.
+	const h = n.header
+	const header = h
+		? Math.ceil(
+				16 +
+					2 +
+					16 +
+					h.icons * (11 + 6) +
+					textWidth(h.label, 0.65) +
+					(h.draft ? 6 + textWidth('draft', 0.65) : 0) +
+					// The menu chevron, or the edit icon of a single script.
+					6 +
+					(h.chevron ? 11 : 10) +
+					4
+			)
+		: 0
+	return Math.min(NODE.width, Math.max(MIN_WIDTH, body, header))
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetsOnlyFolders.ts b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyFolders.ts
new file mode 100644
index 0000000000..4079986ee5
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyFolders.ts
@@ -0,0 +1,25 @@
+// Pipelines open in the assets-only view. This remembers the ones last left
+// showing their scripts and triggers, as `<workspace>/<folder>`, so reopening one
+// shows it the same way. Browser-local: a missing or unreadable list reads as
+// "none", and storage that throws (private mode, blocked site data) is ignored.
+const KEY = 'pipeline-full-view-folders'
+
+function read(): string[] {
+	try {
+		const parsed = JSON.parse(localStorage.getItem(KEY) ?? '[]')
+		return Array.isArray(parsed) ? parsed.filter((f) => typeof f === 'string') : []
+	} catch {
+		return []
+	}
+}
+
+export function isAssetsOnlyFolder(folder: string): boolean {
+	return !read().includes(folder)
+}
+
+export function setAssetsOnlyFolder(folder: string, on: boolean): void {
+	const rest = read().filter((f) => f !== folder)
+	try {
+		localStorage.setItem(KEY, JSON.stringify(on ? rest : [...rest, folder]))
+	} catch {}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.test.ts b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.test.ts
new file mode 100644
index 0000000000..0f2cf472ac
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.test.ts
@@ -0,0 +1,162 @@
+import { describe, expect, it } from 'vitest'
+import {
+	assetsOnlyView,
+	upstreamDeletion,
+	noAssetNodeId,
+	withoutPassiveReads,
+	type AssetUpstream
+} from './assetsOnlyView'
+
+const node = (id: string, type: string, data: any = {}) => ({ id, type, data })
+const edge = (source: string, target: string, kind: string) => ({
+	id: `${kind}:${source}->${target}`,
+	source,
+	target,
+	kind
+})
+
+describe('assetsOnlyView', () => {
+	const nodes = [
+		node('asset:ducklake:raw', 'asset'),
+		node('asset:ducklake:clean', 'asset'),
+		node('asset:ducklake:report', 'asset'),
+		node('script:f/p/clean', 'runnable'),
+		node('script:f/p/report', 'runnable'),
+		node('script:f/p/other', 'runnable'),
+		node('trigger:schedule:f/p/daily', 'trigger', { kind: 'schedule', schedule: '0 0 4 * * *' })
+	]
+	const edges = [
+		edge('trigger:schedule:f/p/daily', 'script:f/p/clean', 'trigger-native'),
+		edge('asset:ducklake:raw', 'script:f/p/clean', 'lineage-read'),
+		edge('script:f/p/clean', 'asset:ducklake:clean', 'lineage-write'),
+		// read-modify-write: no self edge
+		edge('asset:ducklake:clean', 'script:f/p/clean', 'lineage-read'),
+		edge('asset:ducklake:clean', 'script:f/p/report', 'trigger-asset'),
+		edge('asset:ducklake:clean', 'script:f/p/report', 'lineage-read'),
+		edge('script:f/p/report', 'asset:ducklake:report', 'lineage-write'),
+		edge('script:f/p/other', 'asset:ducklake:report', 'lineage-write')
+	]
+	const v = assetsOnlyView(nodes, edges)
+
+	it('joins each script input to its outputs, once', () => {
+		expect(v.edges.map((e) => `${e.source} -> ${e.target}`).sort()).toEqual([
+			'asset:ducklake:clean -> asset:ducklake:report',
+			'asset:ducklake:raw -> asset:ducklake:clean'
+		])
+		expect([...v.nodeIds].sort()).toEqual([
+			'asset:ducklake:clean',
+			'asset:ducklake:raw',
+			'asset:ducklake:report'
+		])
+	})
+
+	it('names the single producer and its trigger, or marks the asset ambiguous', () => {
+		expect(v.upstream.get('asset:ducklake:raw')).toBeUndefined()
+		expect(v.upstream.get('asset:ducklake:clean')).toMatchObject({
+			multiple: false,
+			runnableId: 'script:f/p/clean',
+			trigger: { kind: 'schedule', data: { schedule: '0 0 4 * * *' } }
+		})
+		expect(v.upstream.get('asset:ducklake:report')).toEqual({
+			multiple: true,
+			runnableIds: ['script:f/p/report', 'script:f/p/other']
+		})
+	})
+})
+
+describe('the No asset nodes', () => {
+	it('give each script that builds nothing its own node, fed by what it reads', () => {
+		const v = assetsOnlyView(
+			[
+				node('asset:ducklake:a', 'asset'),
+				node('asset:ducklake:b', 'asset'),
+				node('script:f/p/on_a', 'runnable'),
+				node('script:f/p/on_b', 'runnable'),
+				node('script:f/p/dbt', 'runnable', { dbt: { model_count: 3 } }),
+				node('script:f/p/macros', 'runnable', { macros: [{ name: 'm' }] })
+			],
+			[
+				edge('asset:ducklake:a', 'script:f/p/on_a', 'trigger-asset'),
+				edge('asset:ducklake:b', 'script:f/p/on_b', 'trigger-asset')
+			]
+		)
+		const onA = noAssetNodeId('script:f/p/on_a')
+		const onB = noAssetNodeId('script:f/p/on_b')
+		expect(v.noAssetNodeIds).toEqual([onA, onB])
+		expect(v.upstream.get(onA)).toMatchObject({ runnableId: 'script:f/p/on_a' })
+		expect(v.edges.map((e) => `${e.source} -> ${e.target}`)).toEqual([
+			`asset:ducklake:a -> ${onA}`,
+			`asset:ducklake:b -> ${onB}`
+		])
+	})
+})
+
+describe('upstreamDeletion', () => {
+	const script = { runnable_kind: 'script', path: 'f/p/a' }
+	const schedule = (targets: string[]) => ({
+		kind: 'schedule',
+		nodeId: 'trigger:schedule:f/p/a_schedule',
+		data: { ref: 'f/p/a_schedule', runnable_paths: targets }
+	})
+	const own = (trigger?: any): AssetUpstream & { multiple: false } => ({
+		multiple: false,
+		runnableId: 'script:f/p/a',
+		trigger
+	})
+
+	it('deletes the script and a trigger that fires only it', () => {
+		const u = own(schedule(['f/p/a']))
+		expect(upstreamDeletion(u, script, new Map([['asset:x', u]]))).toEqual({
+			script: { path: 'f/p/a', unsaved: false },
+			trigger: { kind: 'schedule', path: 'f/p/a_schedule', draft: false }
+		})
+	})
+
+	it('keeps a trigger that fires other scripts', () => {
+		const u = own(schedule(['f/p/a', 'f/p/b']))
+		expect(upstreamDeletion(u, script, new Map([['asset:x', u]]))?.trigger).toBeUndefined()
+	})
+
+	it('deletes nothing when the script also co-produces another asset', () => {
+		const u = own(schedule(['f/p/a']))
+		const all = new Map<string, AssetUpstream>([
+			['asset:x', u],
+			['asset:y', { multiple: true, runnableIds: ['script:f/p/a', 'script:f/p/b'] }]
+		])
+		expect(upstreamDeletion(u, script, all)).toBeUndefined()
+	})
+
+	it('deletes nothing when the script builds another asset too', () => {
+		const u = own(schedule(['f/p/a']))
+		const all = new Map([
+			['asset:x', u],
+			['asset:y', u]
+		])
+		expect(upstreamDeletion(u, script, all)).toBeUndefined()
+	})
+})
+
+describe('withoutPassiveReads', () => {
+	it('drops reads that trigger nothing, and the assets only they drew', () => {
+		const nodes = [
+			node('asset:src', 'asset'),
+			node('asset:lookup', 'asset'),
+			node('asset:out', 'asset'),
+			node('script:a', 'runnable')
+		]
+		const edges = [
+			edge('asset:src', 'script:a', 'lineage-read'),
+			edge('asset:src', 'script:a', 'trigger-asset'),
+			edge('asset:lookup', 'script:a', 'lineage-read'),
+			edge('asset:out', 'script:a', 'lineage-read'),
+			edge('script:a', 'asset:out', 'lineage-write')
+		]
+		const r = withoutPassiveReads(nodes, edges)
+		expect(r.nodes.map((n) => n.id)).toEqual(['asset:src', 'asset:out', 'script:a'])
+		expect(r.edges.map((e) => e.id)).toEqual([
+			'lineage-read:asset:src->script:a',
+			'trigger-asset:asset:src->script:a',
+			'lineage-write:script:a->asset:out'
+		])
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.ts b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.ts
new file mode 100644
index 0000000000..c7bf85d144
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.ts
@@ -0,0 +1,234 @@
+import type { NativeTriggerKind } from './types'
+
+/** A node or edge of the canvas model, reduced to what the assets-only view reads. */
+export type ViewNode = { id: string; type: string; data: any }
+export type ViewEdge = {
+	id: string
+	source: string
+	target: string
+	kind: string
+	unsaved?: boolean
+	/** Assets-only edges: the folded runnables the data goes through. */
+	via?: string[]
+	/** Assets-only edges: a write to the source reruns one of `via`. */
+	reactive?: boolean
+}
+
+/** The assets-only node standing for a script that builds no asset: one per
+ * script, so scripts reacting to different inputs stay apart. */
+export const noAssetNodeId = (runnableId: string) => `no-asset:${runnableId}`
+export const isNoAssetNode = (id: string) => id.startsWith('no-asset:')
+
+/** What an assets-only delete removes: the script, its trigger, or both. */
+export type AssetUpstreamDelete = {
+	script?: { path: string; unsaved: boolean }
+	trigger?: { kind: NativeTriggerKind; path: string; draft: boolean }
+}
+
+/** What an asset shows of the script and trigger that produce it, in the assets-only view. */
+export type AssetUpstream =
+	/** Several producing scripts, or one with several triggers. */
+	| { multiple: true; runnableIds: string[] }
+	| {
+			multiple: false
+			/** Canvas id of the producing runnable (`script:<path>`). */
+			runnableId: string
+			/** The producer's trigger; undefined when nothing triggers it (run by hand). */
+			trigger?: { nodeId?: string; kind: string; data?: any }
+	  }
+
+/**
+ * The asset → asset view of a pipeline graph: runnables and triggers disappear,
+ * and every read (or asset trigger) of a script is joined to each of its writes,
+ * so an asset points at the assets computed from it. Each produced asset keeps a
+ * reference to its single producer and that producer's single trigger, or is
+ * marked `multiple` when either is ambiguous.
+ */
+export function assetsOnlyView<N extends ViewNode, E extends ViewEdge>(
+	nodes: N[],
+	edges: E[]
+): {
+	nodeIds: Set<string>
+	edges: Array<ViewEdge>
+	upstream: Map<string, AssetUpstream>
+	/** A node per script that builds no asset (`noAssetNodeId`), its upstream
+	 * under that id. */
+	noAssetNodeIds: string[]
+} {
+	const nodeById = new Map(nodes.map((n) => [n.id, n]))
+	const inputsOf = new Map<string, E[]>()
+	const triggersOf = new Map<string, E[]>()
+	const producersOf = new Map<string, E[]>()
+	const push = (m: Map<string, E[]>, k: string, e: E) => m.set(k, [...(m.get(k) ?? []), e])
+	for (const e of edges) {
+		if (e.kind === 'lineage-write') push(producersOf, e.target, e)
+		else if (e.kind === 'lineage-read' || e.kind === 'trigger-asset') {
+			push(inputsOf, e.target, e)
+			if (e.kind === 'trigger-asset') push(triggersOf, e.target, e)
+		} else if (e.kind === 'trigger-native') push(triggersOf, e.target, e)
+	}
+
+	const triggered = new Set(
+		edges.filter((e) => e.kind === 'trigger-asset').map((e) => `${e.source}\n${e.target}`)
+	)
+	const out = new Map<string, ViewEdge>()
+	for (const [assetId, writes] of producersOf) {
+		for (const w of writes) {
+			for (const r of inputsOf.get(w.source) ?? []) {
+				// A read-modify-write of the same table is not a dependency on itself.
+				if (r.source === assetId) continue
+				const id = `flow:${r.source}->${assetId}`
+				const prev = out.get(id)
+				const unsaved = !!(w.unsaved || r.unsaved)
+				const reactive = triggered.has(`${r.source}\n${w.source}`)
+				if (prev) {
+					prev.unsaved = prev.unsaved && unsaved
+					prev.reactive ||= reactive
+					if (!prev.via?.includes(w.source)) prev.via = [...(prev.via ?? []), w.source]
+				} else {
+					out.set(id, {
+						id,
+						source: r.source,
+						target: assetId,
+						kind: 'asset-flow',
+						unsaved,
+						reactive,
+						via: [w.source]
+					})
+				}
+			}
+		}
+	}
+	for (const e of edges) if (e.kind === 'dbt-ref') out.set(e.id, e)
+
+	function describe(runnableIds: string[]): AssetUpstream {
+		if (runnableIds.length !== 1) return { multiple: true, runnableIds }
+		const runnableId = runnableIds[0]
+		// Every asset trigger of a script is one cause, "an input changed".
+		const triggers = [
+			...new Map(
+				(triggersOf.get(runnableId) ?? []).map((t) => [
+					t.kind === 'trigger-asset' ? 'asset' : t.source,
+					t
+				])
+			).values()
+		]
+		if (triggers.length > 1) return { multiple: true, runnableIds }
+		const t = triggers[0]
+		const tNode = t && nodeById.get(t.source)
+		return {
+			multiple: false,
+			runnableId,
+			trigger: !t
+				? undefined
+				: t.kind === 'trigger-asset'
+					? { kind: 'asset' }
+					: { nodeId: t.source, kind: tNode?.data?.kind, data: tNode?.data }
+		}
+	}
+
+	const upstream = new Map<string, AssetUpstream>()
+	for (const [assetId, writes] of producersOf) {
+		upstream.set(assetId, describe([...new Set(writes.map((w) => w.source))]))
+	}
+
+	// Scripts that build no asset have nowhere to fold into, so each gets a "No
+	// asset" node, fed by what it reads. dbt projects (whose writes are not drawn)
+	// and macro libraries (which build nothing by design) get none.
+	const writers = new Set([...producersOf.values()].flat().map((w) => w.source))
+	const orphans = nodes
+		.filter(
+			(n) => n.type === 'runnable' && !writers.has(n.id) && !n.data?.dbt && !n.data?.macros?.length
+		)
+		.map((n) => n.id)
+	for (const id of orphans) {
+		const nodeId = noAssetNodeId(id)
+		upstream.set(nodeId, describe([id]))
+		for (const r of inputsOf.get(id) ?? []) {
+			const eid = `flow:${r.source}->${nodeId}`
+			const reactive = triggered.has(`${r.source}\n${id}`)
+			const prev = out.get(eid)
+			if (prev) {
+				prev.unsaved = prev.unsaved && !!r.unsaved
+				prev.reactive ||= reactive
+			} else {
+				out.set(eid, {
+					id: eid,
+					source: r.source,
+					target: nodeId,
+					kind: 'asset-flow',
+					unsaved: !!r.unsaved,
+					reactive,
+					via: [id]
+				})
+			}
+		}
+	}
+
+	const nodeIds = new Set(nodes.filter((n) => n.type === 'asset').map((n) => n.id))
+	return {
+		nodeIds,
+		edges: [...out.values()],
+		upstream,
+		noAssetNodeIds: orphans.map(noAssetNodeId)
+	}
+}
+
+/** What deleting an asset's upstream removes: the script unless another asset
+ * is also built by it, and with it the trigger unless that fires other scripts.
+ * Undefined when nothing can go. */
+export function upstreamDeletion(
+	u: AssetUpstream & { multiple: false },
+	r: { runnable_kind: string; path: string; unsaved?: boolean },
+	all: Map<string, AssetUpstream>
+): AssetUpstreamDelete | undefined {
+	if (r.runnable_kind !== 'script') return undefined
+	const producesOthers =
+		[...all.values()].filter((o) =>
+			o.multiple ? o.runnableIds.includes(u.runnableId) : o.runnableId === u.runnableId
+		).length > 1
+	if (producesOthers) return undefined
+	const t = u.trigger
+	const kind = t?.kind as NativeTriggerKind | undefined
+	const targets: string[] = t?.data?.runnable_paths ?? []
+	const ownTrigger =
+		kind &&
+		kind !== 'webhook' &&
+		kind !== 'data_upload' &&
+		t?.data?.ref &&
+		!t.data.missing &&
+		targets.every((p) => p === r.path)
+	return {
+		script: { path: r.path, unsaved: !!r.unsaved },
+		trigger: ownTrigger ? { kind, path: t.data.ref, draft: !!t.data.draft } : undefined
+	}
+}
+
+/**
+ * The graph without its reads that start nothing: a read edge with no asset
+ * trigger along it, and the assets only such reads drew.
+ */
+export function withoutPassiveReads<N extends ViewNode, E extends ViewEdge>(
+	nodes: N[],
+	edges: E[]
+): { nodes: N[]; edges: E[]; dropped: number } {
+	const triggers = new Set(
+		edges.filter((e) => e.kind === 'trigger-asset').map((e) => `${e.source}\n${e.target}`)
+	)
+	const passive = (e: E) =>
+		e.kind === 'lineage-read' && !triggers.has(`${e.source}\n${e.target}`)
+	const kept = edges.filter((e) => !passive(e))
+	const dropped = edges.length - kept.length
+	if (dropped === 0) return { nodes, edges, dropped }
+	const linked = new Set(
+		kept.filter((e) => e.kind !== 'add-anchor').flatMap((e) => [e.source, e.target])
+	)
+	const readOnly = new Set(
+		edges.filter(passive).map((e) => e.source).filter((id) => !linked.has(id))
+	)
+	return {
+		nodes: nodes.filter((n) => !readOnly.has(n.id)),
+		edges: kept.filter((e) => !readOnly.has(e.source) && !readOnly.has(e.target)),
+		dropped
+	}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/edgeDescription.test.ts b/frontend/src/lib/components/assets/AssetGraph/edgeDescription.test.ts
new file mode 100644
index 0000000000..2aff7a0e81
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/edgeDescription.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest'
+import { describeEdge } from './edgeDescription'
+
+const names: Record<string, string> = {
+	'asset:ducklake:main/raw': 'raw',
+	'asset:ducklake:main/clean': 'clean',
+	'script:f/p/clean': 'Clean',
+	'trigger:schedule:f/p/daily': 'Daily'
+}
+const nameOf = (id: string) => names[id] ?? id
+const dataOf = (id: string) =>
+	id === 'trigger:schedule:f/p/daily'
+		? { kind: 'schedule', schedule: '0 0 12 * * *', timezone: 'UTC' }
+		: undefined
+
+describe('describeEdge', () => {
+	it('names an asset trigger by what runs it: any write, changed or not', () => {
+		expect(
+			describeEdge(
+				{ source: 'asset:ducklake:main/raw', target: 'script:f/p/clean', kind: 'trigger-asset' },
+				nameOf,
+				dataOf
+			)
+		).toEqual({ subject: 'Clean', phrase: 'runs after each write to', object: 'raw' })
+	})
+
+	it("gives a schedule's cadence", () => {
+		expect(
+			describeEdge(
+				{ source: 'trigger:schedule:f/p/daily', target: 'script:f/p/clean', kind: 'trigger-native' },
+				nameOf,
+				dataOf
+			)?.phrase
+		).toBe('runs on schedule: Every day at 12:00 UTC')
+	})
+
+	it('names the folded script on an assets-only edge', () => {
+		expect(
+			describeEdge(
+				{
+					source: 'asset:ducklake:main/raw',
+					target: 'asset:ducklake:main/clean',
+					kind: 'asset-flow',
+					via: ['script:f/p/clean']
+				},
+				nameOf,
+				dataOf
+			)
+		).toEqual({ subject: 'clean', phrase: 'is built from', object: 'raw', note: 'By Clean. A write to raw does not rerun it.' })
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/edgeDescription.ts b/frontend/src/lib/components/assets/AssetGraph/edgeDescription.ts
new file mode 100644
index 0000000000..72d8eb103b
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/edgeDescription.ts
@@ -0,0 +1,110 @@
+import { describeSchedule } from '$lib/utils/describeCron'
+import { isNoAssetNode } from './assetsOnlyView'
+
+/** What a hovered edge says: "`subject` `phrase` `object`", then a note. */
+export type EdgeDescription = { subject: string; phrase: string; object?: string; note?: string }
+
+/** The edge fields the description reads (the canvas model's edge). */
+export type DescribedEdge = {
+	source: string
+	target: string
+	kind: string
+	unsaved?: boolean
+	muted?: boolean
+	missing?: boolean
+	via?: string[]
+	reactive?: boolean
+	macro_names?: string[]
+	via_use?: boolean
+}
+
+// What starts a script, per trigger kind: "runs on <event>".
+const TRIGGER_EVENT: Record<string, string> = {
+	kafka: 'Kafka message',
+	mqtt: 'MQTT message',
+	amqp: 'AMQP message',
+	nats: 'NATS message',
+	sqs: 'SQS message',
+	gcp: 'Pub/Sub message',
+	email: 'incoming email',
+	postgres: 'Postgres event',
+	webhook: 'webhook call',
+	data_upload: 'data upload'
+}
+
+/**
+ * The relationship an edge draws, as a sentence about its two ends. `nameOf`
+ * names a node, `dataOf` gives its data (a trigger's kind and cadence).
+ */
+export function describeEdge(
+	e: DescribedEdge,
+	nameOf: (id: string) => string,
+	dataOf: (id: string) => any
+): EdgeDescription | undefined {
+	const src = nameOf(e.source)
+	const tgt = nameOf(e.target)
+	const draft = e.unsaved ? 'Not deployed yet.' : undefined
+	switch (e.kind) {
+		case 'lineage-write':
+			return { subject: src, phrase: 'writes to', object: tgt, note: draft }
+		case 'lineage-read':
+			return {
+				subject: tgt,
+				phrase: 'reads from',
+				object: src,
+				note: e.muted ? 'A write to it does not run the script (muted).' : draft
+			}
+		case 'trigger-asset':
+			return { subject: tgt, phrase: 'runs after each write to', object: src, note: draft }
+		case 'trigger-native': {
+			const t = dataOf(e.source) ?? {}
+			if (e.missing) {
+				return {
+					subject: tgt,
+					phrase: `declares \`// on ${t.kind}\`, but no trigger of that kind targets it`
+				}
+			}
+			const phrase =
+				t.kind === 'schedule' && t.schedule
+					? `runs on schedule: ${describeSchedule(t.schedule, t.timezone) ?? t.schedule}`
+					: `runs on ${TRIGGER_EVENT[t.kind] ?? `${t.kind} trigger`}`
+			return { subject: tgt, phrase, note: t.draft ? 'Draft trigger, created on save.' : draft }
+		}
+		case 'asset-flow': {
+			const via = (e.via ?? []).map(nameOf).join(', ')
+			const rerun = e.reactive
+				? `Each write to ${src} reruns it.`
+				: `A write to ${src} does not rerun it.`
+			// The scripts that build nothing only read: name them, not the node.
+			if (isNoAssetNode(e.target)) {
+				return { subject: src, phrase: 'is read by', object: via || tgt, note: rerun }
+			}
+			return {
+				subject: tgt,
+				phrase: 'is built from',
+				object: src,
+				note: via ? `By ${via}. ${rerun}` : rerun
+			}
+		}
+		case 'dbt-ref':
+			return { subject: tgt, phrase: 'references', object: src, note: 'dbt ref().' }
+		case 'macro':
+			return {
+				subject: tgt,
+				phrase: e.via_use ? 'uses the macro library' : 'uses macros from',
+				object: src,
+				note: e.macro_names?.length ? e.macro_names.join(', ') : undefined
+			}
+		case 'test-dependency':
+			return {
+				subject: src,
+				phrase: 'must run before',
+				object: tgt,
+				note: 'Its data test reads what the first one builds.'
+			}
+		case 'data-test':
+			return { subject: tgt, phrase: 'tests', object: src }
+		default:
+			return undefined
+	}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/graphTraversal.test.ts b/frontend/src/lib/components/assets/AssetGraph/graphTraversal.test.ts
index 197d7eca6c..d6cf76c389 100644
--- a/frontend/src/lib/components/assets/AssetGraph/graphTraversal.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/graphTraversal.test.ts
@@ -1,6 +1,8 @@
 import { describe, expect, it } from 'vitest'
 import type { AssetGraphResponse } from './types'
 import {
+	hoverLineage,
+	transitivelyImpliedEdges,
 	buildDownstreamMap,
 	computeDownstreamClosure,
 	computeInducedSchedule
@@ -225,3 +227,44 @@ describe('computeInducedSchedule', () => {
 		expect(sched.cyclic.sort()).toEqual(['b', 'c'])
 	})
 })
+
+describe('hoverLineage', () => {
+	// a → b → c → d, with a side branch x → c and c → y; z is unrelated to b.
+	const edges = [
+		{ source: 'a', target: 'b' },
+		{ source: 'b', target: 'c' },
+		{ source: 'x', target: 'c' },
+		{ source: 'c', target: 'd' },
+		{ source: 'c', target: 'y' },
+		{ source: 'z', target: 'y' }
+	]
+
+	it('reaches everything upstream and downstream, recursively', () => {
+		const l = hoverLineage(edges, 'b')
+		expect([...l.upstream].sort()).toEqual(['a', 'b'])
+		expect([...l.downstream].sort()).toEqual(['b', 'c', 'd', 'y'])
+	})
+
+	it('keeps only the edges on a path through the node', () => {
+		const l = hoverLineage(edges, 'b')
+		expect(edges.filter(l.hasEdge)).toEqual([
+			{ source: 'a', target: 'b' },
+			{ source: 'b', target: 'c' },
+			{ source: 'c', target: 'd' },
+			{ source: 'c', target: 'y' }
+		])
+	})
+})
+
+describe('transitivelyImpliedEdges', () => {
+	it('flags an edge another path already implies, and only that one', () => {
+		const edges = [
+			{ id: 'ab', source: 'a', target: 'b' },
+			{ id: 'bc', source: 'b', target: 'c' },
+			{ id: 'ac', source: 'a', target: 'c' },
+			{ id: 'ad', source: 'a', target: 'd' },
+			{ id: 'ad2', source: 'a', target: 'd' }
+		]
+		expect([...transitivelyImpliedEdges(edges)]).toEqual(['ac'])
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/graphTraversal.ts b/frontend/src/lib/components/assets/AssetGraph/graphTraversal.ts
index cc59e8f3a8..0c9fad6c83 100644
--- a/frontend/src/lib/components/assets/AssetGraph/graphTraversal.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/graphTraversal.ts
@@ -226,3 +226,76 @@ export function computeInducedSchedule(
 	const roots = ordered.filter((n) => (cleanIndegree.get(n) ?? 0) === 0)
 	return { nodes: ordered, edges: cleanEdges, indegree: cleanIndegree, roots, cyclic }
 }
+
+/** What is linked to a node through the drawn graph: everything it depends on
+ * (upstream) and everything depending on it (downstream), both recursive, the
+ * node itself in each. An edge lies on a path through the node exactly when
+ * both its ends are upstream, or both downstream. */
+export type HoverLineage = {
+	upstream: Set<string>
+	downstream: Set<string>
+	hasEdge: (e: { source: string; target: string }) => boolean
+}
+
+export function hoverLineage(
+	edges: ReadonlyArray<{ source: string; target: string }>,
+	id: string
+): HoverLineage {
+	const walk = (from: 'source' | 'target', to: 'source' | 'target') => {
+		const next = new Map<string, string[]>()
+		for (const e of edges) next.set(e[from], [...(next.get(e[from]) ?? []), e[to]])
+		const seen = new Set([id])
+		const stack = [id]
+		while (stack.length) {
+			for (const n of next.get(stack.pop()!) ?? []) {
+				if (!seen.has(n)) {
+					seen.add(n)
+					stack.push(n)
+				}
+			}
+		}
+		return seen
+	}
+	const upstream = walk('target', 'source')
+	const downstream = walk('source', 'target')
+	return {
+		upstream,
+		downstream,
+		hasEdge: (e) =>
+			(upstream.has(e.source) && upstream.has(e.target)) ||
+			(downstream.has(e.source) && downstream.has(e.target))
+	}
+}
+
+/** Ids of the edges another path already implies: an edge A → C when C can be
+ * reached from A through at least one other node (A → B → … → C). Edges joining
+ * the same two nodes don't make each other redundant. */
+export function transitivelyImpliedEdges(
+	edges: ReadonlyArray<{ id: string; source: string; target: string }>
+): Set<string> {
+	const next = new Map<string, Set<string>>()
+	for (const e of edges) {
+		if (e.source === e.target) continue
+		next.set(e.source, (next.get(e.source) ?? new Set()).add(e.target))
+	}
+	// Whether `to` is reachable from `from` without taking the direct step.
+	const reachableAround = (from: string, to: string) => {
+		const seen = new Set<string>([from])
+		const stack = [...(next.get(from) ?? [])].filter((n) => n !== to)
+		for (const n of stack) seen.add(n)
+		while (stack.length) {
+			const cur = stack.pop()!
+			for (const n of next.get(cur) ?? []) {
+				if (n === to) return true
+				if (!seen.has(n)) {
+					seen.add(n)
+					stack.push(n)
+				}
+			}
+		}
+		return false
+	}
+	const implied = new Set<string>()
+	for (const e of edges) if (e.source !== e.target && reachableAround(e.source, e.target)) implied.add(e.id)
+	return implied
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.test.ts b/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.test.ts
new file mode 100644
index 0000000000..bcd9a2c6fd
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest'
+import { onDirectiveTargets } from './onDirectiveTargets'
+
+describe('onDirectiveTargets', () => {
+	it('leaves out what the script feeds, directly or not, and what already triggers it', () => {
+		const nodes = [
+			{ id: 'script:a', type: 'runnable' },
+			{ id: 'script:b', type: 'runnable' },
+			{ id: 'asset:out', type: 'asset' },
+			{ id: 'asset:later', type: 'asset' },
+			{ id: 'asset:in', type: 'asset' },
+			{ id: 'asset:free', type: 'asset' }
+		]
+		const edges = [
+			{ source: 'script:a', target: 'asset:out', kind: 'lineage-write' },
+			{ source: 'asset:out', target: 'script:b', kind: 'trigger-asset' },
+			{ source: 'script:b', target: 'asset:later', kind: 'lineage-write' },
+			{ source: 'asset:in', target: 'script:a', kind: 'trigger-asset' }
+		]
+		expect([...onDirectiveTargets(nodes, edges, 'script:a')]).toEqual(['asset:free'])
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.ts b/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.ts
new file mode 100644
index 0000000000..4fc348dd51
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.ts
@@ -0,0 +1,34 @@
+/**
+ * The asset nodes a script can be subscribed to (`// on <asset>`) by dragging:
+ * every asset except those downstream of it, whose writes it would then run on
+ * in a loop, and those that already trigger it.
+ */
+export function onDirectiveTargets(
+	nodes: Array<{ id: string; type: string }>,
+	edges: Array<{ source: string; target: string; kind: string }>,
+	scriptId: string
+): Set<string> {
+	const next = new Map<string, string[]>()
+	for (const e of edges) {
+		if (e.kind === 'add-anchor') continue
+		next.set(e.source, [...(next.get(e.source) ?? []), e.target])
+	}
+	const downstream = new Set<string>([scriptId])
+	const stack = [scriptId]
+	while (stack.length) {
+		for (const n of next.get(stack.pop()!) ?? []) {
+			if (!downstream.has(n)) {
+				downstream.add(n)
+				stack.push(n)
+			}
+		}
+	}
+	const triggering = new Set(
+		edges.filter((e) => e.kind === 'trigger-asset' && e.target === scriptId).map((e) => e.source)
+	)
+	return new Set(
+		nodes
+			.filter((n) => n.type === 'asset' && !downstream.has(n.id) && !triggering.has(n.id))
+			.map((n) => n.id)
+	)
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
index d1d5c1b233..713ef8f6b2 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
@@ -8,7 +8,8 @@ import type { AssetGraphResponse } from './types'
 function makeHandle(
 	initial: Array<[string, PipelineDraft]> = [],
 	runnables: Array<{ path: string }> = [],
-	folder = 'x'
+	folder = 'x',
+	triggers: unknown[] = []
 ) {
 	let drafts = new Map(initial)
 	let forgotten: string[] = []
@@ -16,11 +17,13 @@ function makeHandle(
 		getFolder: () => folder,
 		getWorkspace: () => 'w',
 		getResolvedGraph: () =>
-			({ assets: [], runnables, edges: [], triggers: [] }) as unknown as AssetGraphResponse,
+			({ assets: [], runnables, edges: [], triggers }) as unknown as AssetGraphResponse,
 		getDrafts: () => drafts,
 		setDrafts: (next) => (drafts = next),
 		newDraftLocalId: () => 'id',
-		onForgetPath: (p) => forgotten.push(p)
+		onForgetPath: (p) => forgotten.push(p),
+		getTriggerDrafts: () => new Map(),
+		setTriggerDraft: () => true
 	})
 	return { handle, drafts: () => drafts, forgotten: () => forgotten }
 }
@@ -155,6 +158,30 @@ describe('pipeline AI direct-draft helpers', () => {
 		expect(res.detectedWrites).toEqual(['ducklake://main/out'])
 	})
 
+	// The canvas draws an inactive draft's stored outputs beside its materialize
+	// target, so a seeded default left on a materialize node shows a phantom asset.
+	it('keeps no seeded or stale output on a node with a materialize target', async () => {
+		vi.spyOn(ScriptService, 'getScriptByPath').mockRejectedValue(new Error('404'))
+		const { handle, drafts } = makeHandle()
+		await handle.proposeNode({
+			path: 'f/x/mat',
+			language: 'duckdb' as any,
+			content: '-- pipeline\n-- materialize ducklake://main/abc\nSELECT 1',
+			outputKind: 'ducklake' as any
+		})
+		expect(drafts().get('f/x/mat')?.outputAssets).toBeUndefined()
+
+		await handle.proposeNode({
+			path: 'f/x/later',
+			language: 'duckdb' as any,
+			content: '-- pipeline\nSELECT 1',
+			outputKind: 'ducklake' as any
+		})
+		expect(drafts().get('f/x/later')?.outputAssets?.length).toBeGreaterThan(0)
+		await handle.editNode('f/x/later', '-- pipeline\n-- materialize ducklake://main/abc\nSELECT 1')
+		expect(drafts().get('f/x/later')?.outputAssets).toBeUndefined()
+	})
+
 	it('editNode rejects a path outside the open folder', async () => {
 		const { handle, drafts } = makeHandle()
 		await expect(handle.editNode('f/other/foo', '-- pipeline')).rejects.toThrow(/open folder/)
@@ -181,4 +208,24 @@ describe('pipeline AI direct-draft helpers', () => {
 		expect(d?.script.tag).toBe('custom')
 		expect(d?.script.content).toBe('-- pipeline\nSELECT 2')
 	})
+
+	it("does not take a flow's schedule at the same path for the script's", async () => {
+		const flowSchedule = {
+			trigger_kind: 'schedule',
+			runnable_kind: 'flow',
+			runnable_path: 'f/x/ingest',
+			path: 'f/x/flow_schedule'
+		}
+		const content = '# pipeline\n# on schedule\ndef main():\n    return 1'
+		const { handle } = makeHandle(
+			[['f/x/ingest', draft({ script: { content, language: 'python3' } as any })]],
+			[],
+			'x',
+			[flowSchedule]
+		)
+		expect(await handle.unconfiguredTriggers('f/x/ingest')).toEqual(['schedule'])
+		await expect(
+			handle.setNodeTrigger('f/x/ingest', 'schedule', { schedule: '0 0 6 * * *', timezone: 'UTC' })
+		).resolves.toMatchObject({ path: 'f/x/ingest_schedule' })
+	})
 })
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
index 5b22a098b1..f84848ee95 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
@@ -9,7 +9,12 @@ import {
 import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 import { assetUri, autoOutputAsset, type PipelineOutputKind } from './pipelineTemplates'
 import { parsePipelineAnnotations, scd2CurrentTargetPath } from './parsePipelineAnnotations'
-import type { AssetGraphResponse } from './types'
+import type {
+	AssetGraphResponse,
+	PipelineTriggerDraft,
+	PipelineTriggerDraftKind
+} from './types'
+import { defaultTriggerPath, isDraftableTriggerKind, triggerDraftKey } from './pipelineTriggerDrafts'
 import type {
 	PipelineAIChatHelpers,
 	PipelineContext,
@@ -62,20 +67,26 @@ export type PipelineAiHelperDeps = {
 	onForgetPath?: (path: string) => void
 	/** Notify the caller a test run started so it can light up its run UI. */
 	onRunStarted?: (jobId: string, path: string) => void
+	/** Whether the folder has trigger drafts, which live beside the script drafts. */
+	hasTriggerDrafts?: () => boolean
+	getTriggerDrafts: () => Map<string, PipelineTriggerDraft>
+	/** False when another trigger draft already holds the config's path. */
+	setTriggerDraft: (d: PipelineTriggerDraft, previousKey?: string) => boolean
 }
 
 export function makePipelineScript(
 	language: ScriptLang,
 	scriptPath: string,
 	content: string,
-	createdAt: string
+	createdAt: string,
+	summary = ''
 ): Script {
 	// Cast through unknown: a local draft only needs path/language/content/schema;
 	// the many readonly deployment fields on Script don't matter until createScript.
 	return {
 		hash: '',
 		path: scriptPath,
-		summary: '',
+		summary,
 		description: '',
 		content,
 		schema: emptySchema(),
@@ -199,7 +210,7 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 					path: r.path,
 					language: draft?.script.language,
 					unsaved: r.unsaved ?? false,
-					summary: draft?.script.summary || undefined,
+					summary: (draft ? draft.script.summary : r.summary) || undefined,
 					writes: [...new Set(writes)],
 					reads: [...new Set(reads)],
 					triggers: [...new Set(triggers)]
@@ -213,7 +224,36 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 		}
 	}
 
+	// Declared `on <kind>` bindings of a node that a trigger row or draft fills.
+	// Webhook and data-upload need none, so they never count as unconfigured.
+	function unconfiguredTriggers(path: string, content: string): PipelineTriggerDraftKind[] {
+		const declared = parsePipelineAnnotations(content)
+			.nativeTriggers.map((n) => n.kind)
+			.filter(isDraftableTriggerKind)
+		const drafted = new Set(
+			[...deps.getTriggerDrafts().values()]
+				.filter((d) => d.config.script_path === path)
+				.map((d) => d.kind)
+		)
+		const deployed = new Set(
+			deps
+				.getResolvedGraph()
+				.triggers.filter(
+					(t) =>
+						t.trigger_kind !== 'asset' &&
+						t.runnable_kind === 'script' &&
+						t.runnable_path === path &&
+						t.path &&
+						!t.missing
+				)
+				.map((t) => t.trigger_kind)
+		)
+		return [...new Set(declared)].filter((k) => !drafted.has(k) && !deployed.has(k))
+	}
+
 	const helpers: PipelineAIChatHelpers = {
+		getFolder: folderName,
+		hasDrafts: () => deps.getDrafts().size > 0 || (deps.hasTriggerDrafts?.() ?? false),
 		getPipelineContext: buildContext,
 		getNodeBody: async (path) => {
 			const draft = deps.getDrafts().get(path)
@@ -227,7 +267,7 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 				return undefined
 			}
 		},
-		proposeNode: async ({ path, language, content, outputKind }) => {
+		proposeNode: async ({ path, language, content, outputKind, summary }) => {
 			deps.ensureEditable?.()
 			// build_pipeline_node creates a NEW node in the OPEN folder. Reject a path
 			// outside the folder (it would silently stage into this folder's bundle)
@@ -267,10 +307,13 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 			}
 			const inferred = await inferDraftAssets(language, content)
 			// Fall back to a seeded output (from the declared output_kind) when the
-			// body doesn't yet write anything inferable.
+			// body doesn't yet write anything inferable. A `materialize` target is the
+			// output already (the canvas adds it from the annotation): a seed beside it
+			// would show as a second, default-named output.
+			const materialized = materializeWrites(content).length > 0
 			const seeded =
 				inferred.writes[0] ??
-				(outputKind
+				(outputKind && !materialized
 					? autoOutputAsset(outputKind as PipelineOutputKind, folderName(), language)
 					: undefined)
 			// Effective outputs = what actually becomes an output edge on the canvas:
@@ -280,7 +323,7 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 			const next = new Map(drafts)
 			next.set(path, {
 				localId: deps.newDraftLocalId(),
-				script: makePipelineScript(language, path, content, new Date().toISOString()),
+				script: makePipelineScript(language, path, content, new Date().toISOString(), summary),
 				outputAssets,
 				inputAssets: inferred.reads
 			})
@@ -298,7 +341,7 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 				)
 			}
 		},
-		editNode: async (path, content) => {
+		editNode: async (path, content, summary) => {
 			deps.ensureEditable?.()
 			assertInFolder(path)
 			assertPipelineAnnotation(content)
@@ -319,11 +362,19 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 				baseScript = await ScriptService.getScriptByPath({ workspace, path })
 			}
 			const inferred = await inferDraftAssets(baseScript.language, content)
-			const outputAssets = inferred.writes.length > 0 ? inferred.writes : existing?.outputAssets
+			// The stored outputs only stand in for a body that writes nothing inferable;
+			// with a `materialize` target the annotation is the output, so stale ones
+			// (a seeded default name, the target before a rename) must not linger.
+			const outputAssets =
+				inferred.writes.length > 0
+					? inferred.writes
+					: materializeWrites(content).length > 0
+						? undefined
+						: existing?.outputAssets
 			const next = new Map(drafts)
 			next.set(path, {
 				localId: existing?.localId ?? deps.newDraftLocalId(),
-				script: { ...baseScript, content },
+				script: { ...baseScript, content, ...(summary !== undefined ? { summary } : {}) },
 				outputAssets,
 				inputAssets: inferred.reads
 			})
@@ -332,12 +383,61 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 			deps.onProposeNode?.(path)
 			// Deployable lineage only (see proposeNode): body writes + materialize target.
 			return {
+				summary: summary ?? baseScript.summary ?? '',
 				detectedReads: inferred.reads.map(assetUri),
 				detectedWrites: dedupeAssets([...inferred.writes, ...materializeWrites(content)]).map(
 					assetUri
 				)
 			}
 		},
+		unconfiguredTriggers: async (path) => {
+			const body = await helpers.getNodeBody(path)
+			return body ? unconfiguredTriggers(path, body.content) : []
+		},
+		setNodeTrigger: async (path, kind, config) => {
+			deps.ensureEditable?.()
+			assertInFolder(path)
+			const body = await helpers.getNodeBody(path)
+			if (!body) throw new Error(`No pipeline node at '${path}'. Build it first.`)
+			const prefix = body.language === 'python3' || body.language === 'bash' ? '#' : body.language === 'duckdb' || body.language === 'postgresql' ? '--' : '//'
+			if (!parsePipelineAnnotations(body.content).nativeTriggers.some((n) => n.kind === kind)) {
+				throw new Error(
+					`'${path}' does not declare \`${prefix} on ${kind}\`. Add that annotation line with edit_pipeline_node first, so the trigger is wired to the node.`
+				)
+			}
+			const row = deps
+				.getResolvedGraph()
+				.triggers.find(
+					(t) =>
+						t.trigger_kind === kind &&
+						t.runnable_kind === 'script' &&
+						t.runnable_path === path &&
+						t.path &&
+						!t.missing &&
+						!(t as { draft?: boolean }).draft
+				)
+			if (row && 'path' in row) {
+				throw new Error(
+					`'${path}' already has a deployed ${kind} trigger at '${row.path}'. Change that one instead of adding a second.`
+				)
+			}
+			const existing = [...deps.getTriggerDrafts().values()].find(
+				(d) => d.kind === kind && d.config.script_path === path
+			)
+			const triggerPath =
+				(typeof config.path === 'string' && config.path) ||
+				existing?.config.path ||
+				defaultTriggerPath(path, kind)
+			const saved = deps.setTriggerDraft(
+				{ kind, config: { ...config, path: triggerPath, script_path: path, is_flow: false } },
+				existing ? triggerDraftKey(kind, existing.config.path) : undefined
+			)
+			if (!saved) {
+				throw new Error(`Another draft trigger already uses the path '${triggerPath}'. Pass a different config.path.`)
+			}
+			deps.onShowDrafts?.()
+			return { path: triggerPath, replaced: !!existing }
+		},
 		removeProposedNode: async (path) => {
 			if (!deps.getDrafts().has(path)) {
 				throw new Error(`No unsaved draft at '${path}' to discard.`)
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.test.ts
new file mode 100644
index 0000000000..8759f114b4
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.test.ts
@@ -0,0 +1,66 @@
+import { describe, expect, it } from 'vitest'
+import {
+	addTriggerDirective,
+	listenToAsset,
+	removeTriggerDirective,
+	stopListeningToAsset
+} from './pipelineAnnotationEdits'
+
+const table = { kind: 'datatable' as const, path: 'main/orders' }
+const lake = { kind: 'ducklake' as const, path: 'main/orders' }
+
+describe('pipeline annotation edits', () => {
+	it('adds `on` at the end of the header, in its comment style, leaving the body', () => {
+		const sql = '-- pipeline\n-- materialize ducklake://main/x\nSELECT 1; -- on nothing'
+		expect(listenToAsset(sql, table, false)).toBe(
+			'-- pipeline\n-- materialize ducklake://main/x\n-- on datatable://main/orders\nSELECT 1; -- on nothing'
+		)
+	})
+
+	it('adds `on` next to the existing `on` lines', () => {
+		const sql = '-- pipeline\n-- on schedule\n-- materialize ducklake://main/x\nSELECT 1;'
+		expect(listenToAsset(sql, table, false)).toBe(
+			'-- pipeline\n-- on schedule\n-- on datatable://main/orders\n-- materialize ducklake://main/x\nSELECT 1;'
+		)
+	})
+
+	it('removes an `on` line however it is spelled, options included', () => {
+		const py = '# pipeline\n# on datatable://main/orders debounce=60s\nprint(1)'
+		expect(stopListeningToAsset(py, table, true)).toBe('# pipeline\nprint(1)')
+	})
+
+	it('unmutes an auto-triggering read rather than adding `on`, and mutes it to stop', () => {
+		const muted = '// pipeline\n// mute ducklake://main/orders\nexport function main() {}'
+		expect(listenToAsset(muted, lake, true)).toBe('// pipeline\nexport function main() {}')
+		expect(stopListeningToAsset('// pipeline\nexport function main() {}', lake, true)).toBe(
+			'// pipeline\n// mute ducklake://main/orders\nexport function main() {}'
+		)
+	})
+
+	it('adds `on` for an auto-triggering kind the script does not read', () => {
+		expect(listenToAsset('-- pipeline\nSELECT 1;', lake, false)).toBe(
+			'-- pipeline\n-- on ducklake://main/orders\nSELECT 1;'
+		)
+	})
+
+	it('mutes only an auto-triggering asset the script reads', () => {
+		const sub = '-- pipeline\n-- on ducklake://main/orders\nSELECT 1;'
+		expect(stopListeningToAsset(sub, lake, false)).toBe('-- pipeline\nSELECT 1;')
+	})
+
+	it('adds `on` for an auto-triggering kind when every read is muted', () => {
+		const all = '// pipeline\n// mute all\nexport function main() {}'
+		expect(listenToAsset(all, lake, true)).toBe(
+			'// pipeline\n// mute all\n// on ducklake://main/orders\nexport function main() {}'
+		)
+	})
+
+	it('adds a trigger kind once, and drops it', () => {
+		expect(addTriggerDirective('// pipeline\n// on webhook\nx()', 'webhook')).toBe(
+			'// pipeline\n// on webhook\nx()'
+		)
+		expect(removeTriggerDirective('// pipeline\n// on kafka\nx()', 'kafka')).toBe(
+			'// pipeline\nx()'
+		)
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.ts
new file mode 100644
index 0000000000..70ab899412
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.ts
@@ -0,0 +1,149 @@
+import type { AssetKind } from '$lib/gen'
+import { parsePipelineAnnotations, type PipelineAnnotations } from './parsePipelineAnnotations'
+
+// Edits to a pipeline script's leading annotation header (`// on …`, `// mute …`),
+// the comment block `parsePipelineAnnotations` reads. Lines are kept in the
+// script's own comment style, and nothing past the header is touched.
+
+/** Asset kind → the prefix of its `// on <ref>` spelling. Mirrors ASSET_KINDS in
+ * backend/parsers/windmill-parser/src/asset_parser.rs. */
+export const ASSET_REF_PREFIX: Record<AssetKind, string> = {
+	s3object: 's3://',
+	resource: '$res:',
+	ducklake: 'ducklake://',
+	datatable: 'datatable://',
+	volume: 'volume://',
+	dbt: 'dbt://'
+}
+
+// A `// pipeline` script reading one of these kinds runs after each write to it
+// unless muted, with no `// on` line (see AUTO_TRIGGER_KINDS in resolveGraph).
+const AUTO_TRIGGER_KINDS: ReadonlySet<AssetKind> = new Set(['ducklake', 's3object'])
+
+export function assetRef(asset: { kind: AssetKind; path: string }): string {
+	return `${ASSET_REF_PREFIX[asset.kind]}${asset.path}`
+}
+
+const PREFIXES = ['//', '--', '#']
+
+type HeaderLine = { index: number; prefix: string; inner: string }
+
+/** The header: leading comment lines (blank lines allowed), up to the first code. */
+function header(lines: string[]): HeaderLine[] {
+	const out: HeaderLine[] = []
+	for (let i = 0; i < lines.length; i++) {
+		const t = lines[i].trimStart()
+		if (t === '') continue
+		const prefix = PREFIXES.find((p) => t.startsWith(p))
+		if (!prefix) break
+		out.push({ index: i, prefix, inner: t.slice(prefix.length).trim() })
+	}
+	return out
+}
+
+// A header line matched the way the parser reads it, so `on <ref> debounce=60s`,
+// `res://` vs `$res:` spellings and dbt path quoting all count as the same line.
+type LineMatch = (parsed: PipelineAnnotations) => boolean
+const onAsset =
+	(asset: { kind: AssetKind; path: string }): LineMatch =>
+	(p) =>
+		p.triggerAssets.some((a) => a.kind === asset.kind && a.path === asset.path)
+const muteAsset =
+	(asset: { kind: AssetKind; path: string }): LineMatch =>
+	(p) =>
+		p.muteAssets.some((a) => a.kind === asset.kind && a.path === asset.path)
+const muteAll: LineMatch = (p) => p.muteAll
+const onTrigger =
+	(kind: string): LineMatch =>
+	(p) =>
+		p.nativeTriggers.some((t) => t.kind === kind)
+
+function matches(line: HeaderLine, match: LineMatch): boolean {
+	return match(parsePipelineAnnotations(`${line.prefix} ${line.inner}`))
+}
+
+function hasDirective(content: string, match: LineMatch): boolean {
+	return header(content.split('\n')).some((l) => matches(l, match))
+}
+
+/** Adds `<prefix> <directive>` in the header's comment style: after the last line
+ * of the same directive (`on`, `mute`), so they stay grouped, else at its end. */
+function addDirective(content: string, directive: string): string {
+	const lines = content.split('\n')
+	const h = header(lines)
+	const keyword = directive.split(/\s/)[0]
+	const sameKind = h.filter((l) => l.inner.split(/\s/)[0] === keyword)
+	const after = sameKind[sameKind.length - 1] ?? h[h.length - 1]
+	const line = `${after?.prefix ?? '//'} ${directive}`
+	lines.splice(after ? after.index + 1 : 0, 0, line)
+	return lines.join('\n')
+}
+
+function removeDirective(content: string, match: LineMatch): string {
+	const lines = content.split('\n')
+	const drop = new Set(
+		header(lines)
+			.filter((l) => matches(l, match))
+			.map((l) => l.index)
+	)
+	return lines.filter((_, i) => !drop.has(i)).join('\n')
+}
+
+/** The script runs after each write to the asset: `// on <ref>`, and any
+ * `// mute <ref>` lifted. An auto-triggering kind it `reads` needs no `// on`
+ * once unmuted, unless `// mute all` still silences it. */
+export function listenToAsset(
+	content: string,
+	asset: { kind: AssetKind; path: string },
+	reads: boolean
+): string {
+	const ref = assetRef(asset)
+	let out = removeDirective(content, muteAsset(asset))
+	const auto = reads && AUTO_TRIGGER_KINDS.has(asset.kind) && !hasDirective(out, muteAll)
+	if (!auto && !hasDirective(out, onAsset(asset))) out = addDirective(out, `on ${ref}`)
+	return out
+}
+
+/** The script no longer runs after writes to the asset: its `// on <ref>` goes,
+ * and an auto-triggering kind it `reads` is muted, since the read alone would
+ * still trigger it. */
+export function stopListeningToAsset(
+	content: string,
+	asset: { kind: AssetKind; path: string },
+	reads: boolean
+): string {
+	const ref = assetRef(asset)
+	let out = removeDirective(content, onAsset(asset))
+	if (reads && AUTO_TRIGGER_KINDS.has(asset.kind) && !hasDirective(out, muteAsset(asset))) {
+		out = addDirective(out, `mute ${ref}`)
+	}
+	return out
+}
+
+/** Adds a `// on <trigger kind>` line (`schedule`, `webhook`, …) unless it has one. */
+export function addTriggerDirective(content: string, kind: string): string {
+	return hasDirective(content, onTrigger(kind)) ? content : addDirective(content, `on ${kind}`)
+}
+
+/** Drops a `// on <trigger kind>` line (`kafka`, `schedule`, …). */
+export function removeTriggerDirective(content: string, kind: string): string {
+	return removeDirective(content, onTrigger(kind))
+}
+
+/** What each edit says it changes, for the button that applies it. */
+export function listenChangeText(
+	asset: { kind: AssetKind; path: string },
+	reads: boolean
+): string {
+	return reads && AUTO_TRIGGER_KINDS.has(asset.kind)
+		? `Removes any \`mute ${assetRef(asset)}\` line (adds \`on ${assetRef(asset)}\` if all reads are muted)`
+		: `Adds \`on ${assetRef(asset)}\``
+}
+export function stopListeningChangeText(
+	asset: { kind: AssetKind; path: string },
+	reads: boolean
+): string {
+	return reads && AUTO_TRIGGER_KINDS.has(asset.kind)
+		? `Removes \`on ${assetRef(asset)}\` and adds \`mute ${assetRef(asset)}\``
+		: `Removes \`on ${assetRef(asset)}\``
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAssetPrefetch.svelte.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAssetPrefetch.svelte.ts
new file mode 100644
index 0000000000..004c6ab8c1
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAssetPrefetch.svelte.ts
@@ -0,0 +1,164 @@
+import { untrack } from 'svelte'
+import { ScriptService, type AssetKind, type ScriptLang } from '$lib/gen'
+import { inferAssets } from '$lib/infer'
+import {
+	extractReads,
+	extractWrites,
+	type AssetWithAltAccessType
+} from '$lib/components/assets/lib'
+import { parsePipelineAnnotations } from './parsePipelineAnnotations'
+import type { AssetGraphResponse, NativeTriggerKind } from './types'
+import type { PipelineEditorState } from './pipelineEditorState.svelte'
+
+type AssetRef = { kind: AssetKind; path: string }
+
+/**
+ * Reads the body of every deployed script of a pipeline's graph and infers its
+ * asset reads/writes and `// on <native trigger>` annotations, so the canvas
+ * draws the edges of scripts the user never opened. The open script's live
+ * buffer wins over its cached body.
+ *
+ * The caches are only-add and keyed by path: the derived maps iterate the
+ * current graph's scripts, so a renamed or deleted script drops out when the
+ * graph refetches. A stale value under a live path does not, so a save through
+ * the editor must `forget` its path for the sweep to read it again.
+ */
+export function usePipelineAssetPrefetch(deps: {
+	getWorkspace: () => string | undefined
+	getGraph: () => AssetGraphResponse | undefined
+	editor: PipelineEditorState
+}) {
+	const pe = deps.editor
+	let bodies = $state<Map<string, string>>(new Map())
+	// Deployed summary + language from the same fetch, for node titles and icons.
+	let scriptMeta = $state<Map<string, { summary?: string; language: ScriptLang }>>(new Map())
+	let inferredAssets = $state<Map<string, AssetWithAltAccessType[]>>(new Map())
+	let prefetching = $state(false)
+	// Bumped by every sweep so one started for an older graph stops writing.
+	let gen = 0
+
+	$effect(() => {
+		const ws = deps.getWorkspace()
+		const g = deps.getGraph()
+		if (!ws || !g) return
+		const sweep = ++gen
+		const targets = untrack(() =>
+			g.runnables
+				.filter((r) => r.usage_kind === 'script')
+				.map((r) => r.path)
+				.filter((p) => !pe.drafts.has(p) && !bodies.has(p))
+		)
+		if (targets.length === 0) return
+		let i = 0
+		const POOL = 6
+		const worker = async () => {
+			while (i < targets.length && sweep === gen) {
+				const path = targets[i++]
+				try {
+					const s = await ScriptService.getScriptByPath({ workspace: ws, path })
+					if (sweep !== gen) return
+					const content = s.content ?? ''
+					const res = await inferAssets(s.language, content)
+					if (sweep !== gen) return
+					const inferred = (res?.assets ?? []) as AssetWithAltAccessType[]
+					untrack(() => {
+						if (!bodies.has(path)) bodies = new Map(bodies).set(path, content)
+						if (!scriptMeta.has(path)) {
+							scriptMeta = new Map(scriptMeta).set(path, {
+								summary: s.summary || undefined,
+								language: s.language
+							})
+						}
+						if (!inferredAssets.has(path)) {
+							inferredAssets = new Map(inferredAssets).set(path, inferred)
+						}
+					})
+				} catch {
+					// Skip — that node just falls back to base-graph edges.
+				}
+			}
+		}
+		prefetching = true
+		const pool = Array.from({ length: Math.min(POOL, targets.length) }, () => worker())
+		void Promise.all(pool).then(() => {
+			if (sweep === gen) prefetching = false
+		})
+	})
+
+	// Both edge maps in one pass over the graph's scripts; they only differ by
+	// extractWrites vs extractReads over the same source.
+	const edges = $derived.by(() => {
+		const writes = new Map<string, AssetRef[]>()
+		const reads = new Map<string, AssetRef[]>()
+		const g = deps.getGraph()
+		if (!g) return { writes, reads }
+		for (const r of g.runnables) {
+			if (r.usage_kind !== 'script') continue
+			const assets =
+				pe.liveBodyAssets.scriptPath === r.path
+					? pe.liveBodyAssets.assets
+					: inferredAssets.get(r.path)
+			if (!assets) continue
+			const w = extractWrites(assets)
+			if (w.length > 0) writes.set(r.path, w)
+			const rd = extractReads(assets)
+			if (rd.length > 0) reads.set(r.path, rd)
+		}
+		return { writes, reads }
+	})
+
+	const annotatedNativeKinds = $derived.by(() => {
+		const out = new Map<string, Set<NativeTriggerKind>>()
+		const g = deps.getGraph()
+		if (!g) return out
+		const livePath = pe.liveAnnotations.scriptPath
+		for (const r of g.runnables) {
+			if (r.usage_kind !== 'script') continue
+			let kinds: Set<NativeTriggerKind>
+			if (r.path === livePath) {
+				kinds = new Set(pe.liveAnnotations.annotations.nativeTriggers.map((n) => n.kind))
+			} else {
+				const body = bodies.get(r.path)
+				if (!body) continue
+				kinds = new Set(parsePipelineAnnotations(body).nativeTriggers.map((n) => n.kind))
+			}
+			if (kinds.size > 0) out.set(r.path, kinds)
+		}
+		return out
+	})
+
+	return {
+		get bodies(): ReadonlyMap<string, string> {
+			return bodies
+		},
+		get scriptMeta(): ReadonlyMap<string, { summary?: string; language: ScriptLang }> {
+			return scriptMeta
+		},
+		get inferredWritesByPath() {
+			return edges.writes
+		},
+		get inferredReadsByPath() {
+			return edges.reads
+		},
+		get annotatedNativeKindsByPath() {
+			return annotatedNativeKinds
+		},
+		get prefetching() {
+			return prefetching
+		},
+		/** Drop cached paths so the next sweep re-reads them (after a save). */
+		forget(...paths: string[]) {
+			const nextBodies = new Map(bodies)
+			const nextMeta = new Map(scriptMeta)
+			const nextInferred = new Map(inferredAssets)
+			for (const p of paths) {
+				nextBodies.delete(p)
+				nextMeta.delete(p)
+				nextInferred.delete(p)
+			}
+			bodies = nextBodies
+			scriptMeta = nextMeta
+			inferredAssets = nextInferred
+		}
+	}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineDataUploads.svelte.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineDataUploads.svelte.ts
new file mode 100644
index 0000000000..8205b5f903
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineDataUploads.svelte.ts
@@ -0,0 +1,87 @@
+import { untrack } from 'svelte'
+import type { AssetGraphResponse } from './types'
+
+type Staged = { args: Record<string, any>; valid: boolean }
+
+// An S3Object-shaped value (the file picker writes `{ s3: '<path>' }`).
+function isS3Object(v: any): boolean {
+	return !!v && typeof v === 'object' && !Array.isArray(v) && 's3' in v
+}
+
+// Whether a staged value carries actual data. Covers the two shapes a
+// data-upload entry takes: an S3Object (file picker → `{ s3: '<path>' }`) and
+// a plain required input (e.g. a JSON array pasted into the run form).
+function hasMeaningfulValue(v: any): boolean {
+	if (v == null) return false
+	if (typeof v === 'string') return v.length > 0
+	if (Array.isArray(v)) return v.length > 0
+	if (typeof v === 'object')
+		return isS3Object(v) ? typeof v.s3 === 'string' && v.s3.length > 0 : Object.keys(v).length > 0
+	return true // numbers / booleans count as provided
+}
+
+/**
+ * Staged run-form input for the graph's data-upload entry scripts, keyed by path.
+ * Lifted out of the (transient, per-selection) run form so the uploaded/entered
+ * data persists across selection changes: it drives each entry node's green
+ * "ready" state and seeds a run with that input. `valid` is the run form's
+ * full-schema validity (all required fields satisfied).
+ */
+export function usePipelineDataUploads(getGraph: () => AssetGraphResponse) {
+	let staged = $state<Record<string, Staged>>({})
+
+	// Scripts that are data-upload entry points (a `data_upload` trigger in the
+	// displayed graph). They can't auto-run — they need their data first.
+	const entryPaths = $derived(
+		new Set(
+			getGraph()
+				.triggers.filter((t) => t.trigger_kind === 'data_upload' && t.runnable_kind === 'script')
+				.map((t) => t.runnable_path)
+		)
+	)
+
+	// Ready once the user actually provided its data, not just opened the form. Two
+	// guards: the form's own full-schema `valid` (every required field — including
+	// non-file ones — is satisfied), AND that any declared S3Object file field
+	// actually carries a file (the picker can leave an empty `{ s3: '' }` on a
+	// non-required file field, which `valid` alone wouldn't catch).
+	function isReady(path: string): boolean {
+		const s = staged[path]
+		if (!s || !s.valid) return false
+		const values = Object.values(s.args)
+		const s3s = values.filter(isS3Object)
+		if (s3s.length > 0) return s3s.every(hasMeaningfulValue)
+		return values.some(hasMeaningfulValue)
+	}
+
+	const readyPaths = $derived(new Set([...entryPaths].filter((p) => isReady(p))))
+
+	return {
+		get entryPaths(): ReadonlySet<string> {
+			return entryPaths
+		},
+		/** Entry scripts with their data provided — drives the green node treatment. */
+		get readyPaths(): ReadonlySet<string> {
+			return readyPaths
+		},
+		isReady,
+		argsFor: (path: string): Record<string, any> | undefined => staged[path]?.args,
+		// Persist the run form's args + validity, but only for data-upload entries —
+		// other run forms (partitioned producers) run their own way and must not be
+		// mistaken for a staged upload. Idempotent: the run form re-emits on every
+		// keystroke/validation pass, so bail when the value is unchanged — otherwise
+		// each emit would reassign `staged`, giving `readyPaths` a fresh Set identity
+		// that re-syncs the canvas and re-fires the form's emit effect
+		// (effect_update_depth_exceeded).
+		// Called from the run forms' own effects, so its reads are untracked: a form
+		// must not re-run because the store it just wrote to changed.
+		stage: (path: string, args: Record<string, any>, valid: boolean) =>
+			untrack(() => {
+				if (!entryPaths.has(path)) return
+				const prev = staged[path]
+				if (prev && prev.valid === valid && JSON.stringify(prev.args) === JSON.stringify(args))
+					return
+				staged = { ...staged, [path]: { args, valid } }
+			})
+	}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.test.ts
new file mode 100644
index 0000000000..1e0c77aa70
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.test.ts
@@ -0,0 +1,52 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { DraftService, ScriptService } from '$lib/gen'
+import { planPipelineDelete } from './pipelineDelete'
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('planPipelineDelete', () => {
+	it("takes only the pipeline's own triggers and addresses draft-only nodes by storage key", async () => {
+		vi.spyOn(ScriptService, 'listRunnables').mockResolvedValue({
+			items: [
+				{ type: 'script', path: 'f/sales/ingest', auto_kind: 'pipeline' },
+				{ type: 'script', path: 'f/sales/report' },
+				{
+					type: 'script',
+					path: 'u/alice/draft_abc',
+					draft_only: true,
+					draft_path: 'f/sales/unpublished',
+					auto_kind: 'pipeline'
+				}
+			]
+		} as any)
+		vi.spyOn(DraftService, 'getOwnDraft').mockResolvedValue(undefined as any)
+		const trigger = (runnable_kind: string, runnable_path: string, path: string) => ({
+			trigger_kind: 'schedule',
+			runnable_kind,
+			runnable_path,
+			path
+		})
+		vi.stubGlobal(
+			'fetch',
+			vi.fn().mockResolvedValue({
+				ok: true,
+				json: async () => ({
+					triggers: [
+						trigger('script', 'f/sales/ingest', 'f/sales/ingest_schedule'),
+						trigger('script', 'f/sales/report', 'f/sales/report_schedule'),
+						trigger('flow', 'f/sales/ingest', 'f/sales/flow_schedule')
+					]
+				})
+			})
+		)
+
+		const plan = await planPipelineDelete('w', 'sales')
+
+		expect(plan.triggers).toEqual([{ kind: 'schedule', path: 'f/sales/ingest_schedule' }])
+		expect(plan.scripts).toEqual([
+			{ path: 'f/sales/ingest', displayPath: 'f/sales/ingest', draftOnly: false },
+			{ path: 'u/alice/draft_abc', displayPath: 'f/sales/unpublished', draftOnly: true }
+		])
+		vi.unstubAllGlobals()
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.ts
new file mode 100644
index 0000000000..62e8e2ea4a
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.ts
@@ -0,0 +1,135 @@
+import { DraftService, OpenAPI, ScriptService, type RunnableItem } from '$lib/gen'
+import { discardDraft } from '$lib/utils_draft_deploy'
+import { PIPELINE_DRAFT_KIND, pipelineBundlePath, pipelineLocalMirrorKey } from '$lib/pipelinePaths'
+import { deleteTriggerRow } from './pipelineTriggerDraftDeploy'
+import type { AssetGraphResponse, NativeTriggerKind } from './types'
+
+export type PipelineDeleteResult = { removed: number; failures: string[] }
+
+/** The folder's pipeline-member scripts, deployed and draft-only alike: every one of
+ * them makes the home list show the pipeline, so one left behind brings it back. */
+async function listPipelineScripts(workspace: string, folder: string): Promise<RunnableItem[]> {
+	const out: RunnableItem[] = []
+	let cursor: string | undefined
+	do {
+		const res = await ScriptService.listRunnables({
+			workspace,
+			kinds: 'script',
+			pathStart: `f/${folder}/`,
+			includeDraftOnly: true,
+			perPage: 100,
+			cursor
+		})
+		out.push(...res.items.filter((it) => it.auto_kind === 'pipeline'))
+		cursor = res.next_cursor ?? undefined
+	} while (cursor)
+	return out
+}
+
+/** Trigger rows starting one of `scripts`. The folder graph also carries the
+ * triggers of the folder's ordinary scripts and flows, which are not the pipeline's. */
+async function listNativeTriggers(workspace: string, folder: string, scripts: ReadonlySet<string>) {
+	const res = await fetch(
+		`${OpenAPI.BASE ?? ''}/w/${workspace}/assets/graph?${new URLSearchParams({ folder })}`,
+		{ credentials: 'include' }
+	)
+	if (!res.ok) throw new Error(`GET /assets/graph → ${res.status}`)
+	const graph = (await res.json()) as AssetGraphResponse
+	return graph.triggers.flatMap((t) =>
+		t.trigger_kind !== 'asset' &&
+			t.runnable_kind === 'script' &&
+			scripts.has(t.runnable_path) &&
+			t.trigger_kind !== 'webhook' &&
+			t.trigger_kind !== 'data_upload' &&
+			t.path &&
+			!t.unsaved
+			? [{ kind: t.trigger_kind, path: t.path }]
+			: []
+	)
+}
+
+export type PipelineDeletePlan = {
+	/** `path` is what the API addresses (a draft-only node's storage key);
+	 * `displayPath` is the path the user typed for it. */
+	scripts: { path: string; displayPath: string; draftOnly: boolean }[]
+	triggers: { kind: NativeTriggerKind; path: string }[]
+	/** Whether the caller has an unsaved pipeline draft for this folder. */
+	hasDraft: boolean
+}
+
+/** Everything `deletePipeline` would remove, so it can be listed before it is. */
+export async function planPipelineDelete(
+	workspace: string,
+	folder: string
+): Promise<PipelineDeletePlan> {
+	const scripts = await listPipelineScripts(workspace, folder)
+	const deployed = new Set(scripts.filter((s) => !s.draft_only).map((s) => s.path))
+	const [triggers, draft] = await Promise.all([
+		listNativeTriggers(workspace, folder, deployed),
+		DraftService.getOwnDraft({
+			workspace,
+			kind: PIPELINE_DRAFT_KIND,
+			path: pipelineBundlePath(folder)
+		}).catch(() => undefined)
+	])
+	return {
+		scripts: scripts.map((s) => ({
+			path: s.path,
+			displayPath: (s.draft_only && s.draft_path) || s.path,
+			draftOnly: !!s.draft_only
+		})),
+		triggers,
+		hasDraft: !!draft
+	}
+}
+
+/** Removes what `plan` lists: the trigger rows, the scripts (deleted when
+ * `hardDelete`, which the backend allows admins only, archived otherwise; a
+ * draft-only node is discarded) and the caller's pipeline draft. The data the
+ * nodes wrote (DuckLake tables, S3 objects) is left alone. Triggers go first: a
+ * script refused afterwards loses its trigger, but no trigger outlives the script
+ * it starts. */
+export async function deletePipeline(
+	workspace: string,
+	folder: string,
+	plan: PipelineDeletePlan,
+	hardDelete: boolean
+): Promise<PipelineDeleteResult> {
+	const failures: string[] = []
+	let removed = 0
+	const fail = (what: string, e: any) =>
+		failures.push(`${what}: ${e?.body ?? e?.message ?? String(e)}`)
+
+	for (const t of plan.triggers) {
+		try {
+			if (await deleteTriggerRow(t.kind, t.path, workspace)) removed++
+		} catch (e) {
+			fail(`${t.kind} trigger ${t.path}`, e)
+		}
+	}
+	for (const s of plan.scripts) {
+		try {
+			if (s.draftOnly) {
+				const r = await discardDraft('script', s.path, workspace, true, false, false)
+				if (!r.success) throw new Error(r.error)
+			} else if (hardDelete) {
+				await ScriptService.deleteScriptByPath({ workspace, path: s.path })
+			} else {
+				await ScriptService.archiveScriptByPath({ workspace, path: s.path })
+			}
+			removed++
+		} catch (e) {
+			fail(s.displayPath, e)
+		}
+	}
+	if (plan.hasDraft) {
+		const bundle = await discardDraft(PIPELINE_DRAFT_KIND, pipelineBundlePath(folder), workspace, true)
+		if (!bundle.success) failures.push(`pipeline draft: ${bundle.error}`)
+	}
+	try {
+		localStorage.removeItem(pipelineLocalMirrorKey(folder))
+	} catch {
+		// Storage unavailable: nothing was mirrored either.
+	}
+	return { removed, failures }
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.svelte.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.svelte.ts
new file mode 100644
index 0000000000..508b705e11
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.svelte.ts
@@ -0,0 +1,230 @@
+import { DraftService, ScriptService, type Script } from '$lib/gen'
+import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
+import type { PipelineTriggerDraft } from './types'
+import type { Schema } from '$lib/common'
+import { emptySchema } from '$lib/utils'
+import { inferArgs, inferAssets } from '$lib/infer'
+import type { AssetWithAltAccessType } from '$lib/components/assets/lib'
+import type { PipelineDraft } from './pipelineAiHelpers'
+import type { PipelineEditorState } from './pipelineEditorState.svelte'
+import { deployTriggerDraft } from './pipelineTriggerDraftDeploy'
+
+// Deploying a pipeline's drafts: the scripts first, then the trigger drafts whose
+// script is now deployed. Shared by the pipeline page's "Save all" and the AI
+// session's "Deploy pipeline", so both deploy exactly the same way.
+
+/** Deploy one pipeline script draft; resolves to the new version's hash. */
+export async function deployPipelineScript(
+	draft: PipelineDraft,
+	workspace: string
+): Promise<string> {
+	const script = structuredClone($state.snapshot(draft.script) as Script)
+	script.schema = script.schema ?? emptySchema()
+	try {
+		const result = await inferArgs(script.language, script.content, script.schema as Schema)
+		;(script as any).auto_kind = result?.auto_kind || undefined
+		script.has_preprocessor = result?.has_preprocessor ?? false
+	} catch {
+		// Inference failures don't block deploys (the same fallback the per-pane
+		// save uses): createScript is the real validation gate.
+	}
+	// Re-infer the lineage from the CURRENT body. `script.assets` is a snapshot
+	// that isn't refreshed on edit, so a renamed/removed output would otherwise be
+	// re-deployed as a phantom write edge.
+	let assets: AssetWithAltAccessType[] = []
+	try {
+		const inferred = await inferAssets(script.language, script.content)
+		if (inferred?.status !== 'error') assets = (inferred?.assets ?? []) as AssetWithAltAccessType[]
+	} catch {
+		// An unparsable body deploys with no lineage rather than the stale snapshot.
+	}
+	return await ScriptService.createScript({
+		workspace,
+		requestBody: {
+			...script,
+			language: script.language,
+			description: script.description ?? '',
+			// A brand-new draft has an empty hash (the backend rejects an empty hex
+			// string); a draft of a deployed script chains off its hash, since
+			// createScript rejects a parentless deploy to an occupied path.
+			parent_hash: script.hash ? String(script.hash) : undefined,
+			is_template: false,
+			tag: script.tag,
+			kind: script.kind as Script['kind'] | undefined,
+			lock: undefined,
+			assets: assets as any
+		}
+	})
+}
+
+// Every field a deploy sends: a draft differing from the live script in any of
+// them still has something to deploy.
+const DEPLOYED_FIELDS = [
+	'content',
+	'language',
+	'summary',
+	'description',
+	'tag',
+	'kind',
+	'labels'
+] as const
+
+/** Whether two versions of a script agree on everything a deploy sends. */
+function sameDeployedFields(a: Partial<Script>, b: Partial<Script>): boolean {
+	const norm = (v: unknown) => JSON.stringify(Array.isArray(v) && v.length === 0 ? null : (v ?? null))
+	return DEPLOYED_FIELDS.every(
+		(f) =>
+			norm(f === 'description' ? (a[f] ?? '') : a[f]) ===
+			norm(f === 'description' ? (b[f] ?? '') : b[f])
+	)
+}
+
+/** Whether a draft equals the live script at its path, i.e. has nothing to deploy. */
+export async function matchesDeployedScript(
+	path: string,
+	d: PipelineDraft,
+	workspace: string
+): Promise<boolean> {
+	try {
+		const live = await ScriptService.getScriptByPath({ workspace, path })
+		return sameDeployedFields(live, d.script)
+	} catch {
+		return false
+	}
+}
+
+/**
+ * A folder's draft bundle against what is deployed, one entry per node (and the
+ * trigger drafts), for a diff viewer: the unit a session reviews and deploys.
+ */
+export async function loadPipelineDraftDiff(
+	workspace: string,
+	folder: string
+): Promise<{ before: unknown; after: unknown }> {
+	const row = await DraftService.getOwnDraft({
+		workspace,
+		kind: PIPELINE_DRAFT_KIND,
+		path: pipelineBundlePath(folder)
+	}).catch(() => undefined)
+	const bundle = (row?.value ?? {}) as {
+		drafts?: Array<[string, PipelineDraft]>
+		triggerDrafts?: PipelineTriggerDraft[]
+	}
+	const drafts = Array.isArray(bundle.drafts) ? bundle.drafts : []
+	const before: Record<string, string> = {}
+	const after: Record<string, string> = {}
+	await Promise.all(
+		drafts.map(async ([path, d]) => {
+			after[path] = d.script?.content ?? ''
+			const live = await ScriptService.getScriptByPath({ workspace, path }).catch(() => undefined)
+			if (live) before[path] = live.content
+		})
+	)
+	const triggers = (bundle.triggerDrafts ?? []).map((t) => ({
+		kind: t.kind,
+		path: t.config.path,
+		script_path: t.config.script_path
+	}))
+	return {
+		before: { nodes: before },
+		after: { nodes: after, ...(triggers.length > 0 ? { new_triggers: triggers } : {}) }
+	}
+}
+
+export type PipelineDeployOutcome = {
+	savedPaths: string[]
+	/** Keys of the trigger drafts that deployed. */
+	savedTriggers: string[]
+	/** Failures by script or trigger path. */
+	errors: Map<string, string>
+}
+
+/**
+ * Deploy every draft of `editor` into `workspace`, dropping from it what deployed:
+ * failed drafts stay so they can be fixed and retried. The open pane's unsaved
+ * keystrokes are deployed with their draft.
+ */
+export async function deployPipelineDrafts(
+	editor: PipelineEditorState,
+	workspace: string
+): Promise<PipelineDeployOutcome> {
+	// Closing the pane lands an open deployed script's edits as its draft, so they
+	// deploy too. It reopens on that script once the deploy is done, unless another
+	// one was opened meanwhile.
+	const reopen =
+		editor.liveEditPath != undefined || editor.activeDraftPath != undefined
+			? await editor.closePane()
+			: undefined
+	const entries = [...editor.drafts.entries()]
+	const errors = new Map<string, string>()
+	const savedPaths: string[] = []
+	const hashes = new Map<string, string>()
+	// Parallel: every createScript is independent, and one bad body must not block
+	// the others.
+	const results = await Promise.allSettled(
+		entries.map(([, d]) => deployPipelineScript(d, workspace))
+	)
+	for (let i = 0; i < results.length; i++) {
+		const r = results[i]
+		const [path, d] = entries[i]
+		if (r.status === 'fulfilled') {
+			savedPaths.push(path)
+			if (r.value) hashes.set(path, r.value)
+			continue
+		}
+		// A refused draft that equals the deployed script has nothing left to deploy.
+		// A duplicate refusal alone does not prove it: it is checked against every
+		// past version, not just the live one.
+		if (await matchesDeployedScript(path, d, workspace)) {
+			savedPaths.push(path)
+			continue
+		}
+		const msg = String((r.reason as any)?.body ?? (r.reason as any)?.message ?? r.reason)
+		errors.set(
+			path,
+			/same hash/i.test(msg)
+				? 'This is the content of an earlier version, which cannot be deployed again as is. Change anything in it (a comment will do) to deploy it.'
+				: msg
+		)
+	}
+
+	// A trigger's `script_path` must already exist, so triggers whose script is
+	// still an undeployed draft stay drafts.
+	const ready = [...editor.triggerDrafts].filter(
+		([, d]) => !editor.drafts.has(d.config.script_path) || savedPaths.includes(d.config.script_path)
+	)
+	const triggerResults = await Promise.all(ready.map(([, d]) => deployTriggerDraft(d, workspace)))
+	const savedTriggers: string[] = []
+	triggerResults.forEach((ok, i) => {
+		const [key, d] = ready[i]
+		if (ok) savedTriggers.push(key)
+		else errors.set(d.config.path, `Could not create the ${d.kind} trigger, see the notification`)
+	})
+	for (const key of savedTriggers) editor.discardTriggerDraft(key)
+
+	if (savedPaths.length > 0) {
+		// A draft edited again while it deployed (its node reopened from the canvas)
+		// keeps the newer edits, now on top of the version just deployed; only a draft
+		// still holding exactly what was sent is done.
+		const sent = new Map(entries.map(([p, d]) => [p, d.script]))
+		const next = new Map<string, PipelineDraft>()
+		for (const [k, d] of editor.drafts) {
+			if (!savedPaths.includes(k)) {
+				next.set(k, d)
+				continue
+			}
+			const open = editor.liveContent.scriptPath === k ? editor.liveContent.content : undefined
+			const now = open === undefined ? d.script : { ...d.script, content: open }
+			const was = sent.get(k)
+			if (was && sameDeployedFields(now, was)) continue
+			const hash = hashes.get(k)
+			next.set(k, hash ? { ...d, script: { ...d.script, hash } } : d)
+		}
+		editor.drafts = next
+	}
+	if (reopen && editor.activeDraftPath === undefined && editor.selection === undefined) {
+		if (editor.drafts.has(reopen)) editor.activeDraftPath = reopen
+		else editor.selection = { kind: 'runnable', runnable_kind: 'script', path: reopen }
+	}
+	return { savedPaths, savedTriggers, errors }
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.test.ts
new file mode 100644
index 0000000000..53df48717a
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const createScript = vi.fn()
+vi.mock('$lib/gen', () => ({
+	ScriptService: { createScript: (a: unknown) => createScript(a) },
+	DraftService: {}
+}))
+vi.mock('$lib/infer', () => ({
+	inferArgs: async () => undefined,
+	inferAssets: async () => ({ status: 'ok', assets: [] })
+}))
+vi.mock('./pipelineTriggerDraftDeploy', () => ({ deployTriggerDraft: async () => true }))
+
+const { deployPipelineDrafts } = await import('./pipelineDeploy.svelte')
+const { PipelineEditorState } = await import('./pipelineEditorState.svelte')
+
+const draft = (content: string) => ({
+	localId: 'pe-1',
+	script: { path: 'f/x/n', language: 'duckdb', content, hash: 'aaaa' } as any
+})
+
+describe('deployPipelineDrafts', () => {
+	it('drops a draft once what it holds is deployed', async () => {
+		const pe = new PipelineEditorState()
+		pe.drafts = new Map([['f/x/n', draft('SELECT 2')]])
+		createScript.mockResolvedValueOnce('bbbb')
+		await deployPipelineDrafts(pe, 'ws')
+		expect(pe.drafts.has('f/x/n')).toBe(false)
+	})
+
+	it('keeps edits made while the deploy was in flight, on top of the new version', async () => {
+		const pe = new PipelineEditorState()
+		pe.drafts = new Map([['f/x/n', draft('SELECT 2')]])
+		createScript.mockImplementationOnce(async () => {
+			pe.drafts = new Map([['f/x/n', draft('SELECT 3')]])
+			return 'bbbb'
+		})
+		await deployPipelineDrafts(pe, 'ws')
+		expect(pe.drafts.get('f/x/n')?.script.content).toBe('SELECT 3')
+		expect(pe.drafts.get('f/x/n')?.script.hash).toBe('bbbb')
+	})
+})
+
+describe('deployPipelineDrafts metadata', () => {
+	it('keeps a summary edited while the deploy was in flight', async () => {
+		const pe = new PipelineEditorState()
+		pe.drafts = new Map([['f/x/n', draft('SELECT 2')]])
+		createScript.mockImplementationOnce(async () => {
+			const d = draft('SELECT 2')
+			pe.drafts = new Map([['f/x/n', { ...d, script: { ...d.script, summary: 'Renamed' } }]])
+			return 'bbbb'
+		})
+		await deployPipelineDrafts(pe, 'ws')
+		expect(pe.drafts.get('f/x/n')?.script.summary).toBe('Renamed')
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.svelte.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.svelte.ts
index 086abc1bf8..6f9a109f5f 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.svelte.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.svelte.ts
@@ -1,6 +1,8 @@
+import { tick } from 'svelte'
 import type { AssetKind, Script } from '$lib/gen'
 import type { AssetWithAltAccessType } from '$lib/components/assets/lib'
-import type { AssetGraphSelection } from './types'
+import type { AssetGraphSelection, PipelineTriggerDraft } from './types'
+import { defaultTriggerPath, triggerDraftKey } from './pipelineTriggerDrafts'
 import {
 	parsePipelineAnnotations,
 	type ColumnLineage,
@@ -26,11 +28,18 @@ type LiveBodyAssets = {
 	assets: AssetWithAltAccessType[]
 	columnLineage?: ColumnLineage[]
 }
-type LiveContent = { scriptPath: string | undefined; content: string }
+type LiveContent = {
+	scriptPath: string | undefined
+	content: string
+	/** The deployed script the buffer was opened from; unset for a draft. */
+	base?: Script
+}
 
 export class PipelineEditorState {
 	/** In-flight drafts keyed by script path (manual + AI-staged). */
 	drafts = $state<Map<string, PipelineDraft>>(new Map())
+	/** Undeployed triggers keyed by `triggerDraftKey`, persisted in the same bundle. */
+	triggerDrafts = $state<Map<string, PipelineTriggerDraft>>(new Map())
 	/** Draft open in the details pane (mutually exclusive with `selection`). */
 	activeDraftPath = $state<string | undefined>(undefined)
 	/** The persisted node/asset selected on the canvas. */
@@ -51,23 +60,22 @@ export class PipelineEditorState {
 	 * autosave hydrate when persistence is enabled. */
 	loadedFromDbDraft = $state(false)
 
-	/** Folder this state is scoped to. Used by the in-session preview (where one
-	 * instance is reused across editor hide/show) to detect a retarget to a
-	 * different folder and reset, so stale drafts don't bleed across folders. */
+	/** Folder this state is scoped to. The route page compares it on a folder
+	 * switch and resets, so one folder's drafts don't bleed into the next. */
 	folder = $state<string | undefined>(undefined)
 
 	/** True once the DB draft bundle for the current folder has been hydrated
-	 * into this instance. Gated per-instance (not per component mount) so the
-	 * in-session preview hydrates ONCE when its runtime is fresh and then keeps
-	 * the in-memory drafts across editor hide/show — re-reading the DB on every
-	 * remount would race a not-yet-flushed autosave and drop a just-staged draft.
-	 * Reset to false on a folder retarget so the new folder re-hydrates. */
+	 * into this instance. Gated per-instance (not per component mount) so an AI
+	 * session's folder hydrates ONCE and then keeps its in-memory drafts across
+	 * editor remounts — re-reading the DB on every remount would race a
+	 * not-yet-flushed autosave and drop a just-staged draft. `reset` clears it
+	 * so a new folder re-hydrates. */
 	hydratedFromDb = $state(false)
 
-	/** Clear all in-flight state. Used when the session preview retargets a
-	 * different pipeline folder (a same-folder remount keeps the drafts). */
+	/** Clear all in-flight state, for the route page switching folders. */
 	reset = () => {
 		this.drafts = new Map()
+		this.triggerDrafts = new Map()
 		this.activeDraftPath = undefined
 		this.selection = undefined
 		this.clearLiveOverlays()
@@ -84,6 +92,18 @@ export class PipelineEditorState {
 		return `pe-${this.#nextDraftLocalId}`
 	}
 
+	// A deployed script with unsaved edits is autosaved as a draft before the pane
+	// promotes it, so both must give it the same id.
+	#promotedLocalIds = new Map<string, string>()
+	promotedDraftLocalId = (path: string): string => {
+		let id = this.#promotedLocalIds.get(path)
+		if (!id) {
+			id = this.newDraftLocalId()
+			this.#promotedLocalIds.set(path, id)
+		}
+		return id
+	}
+
 	handleAnnotationsChange = (scriptPath: string | undefined, annotations: PipelineAnnotations) => {
 		this.liveAnnotations = { scriptPath, annotations }
 	}
@@ -94,8 +114,34 @@ export class PipelineEditorState {
 	) => {
 		this.liveBodyAssets = { scriptPath, assets, columnLineage }
 	}
-	handleContentChange = (scriptPath: string | undefined, content: string) => {
-		this.liveContent = { scriptPath, content }
+	handleContentChange = (scriptPath: string | undefined, content: string, base?: Script) => {
+		this.liveContent = { scriptPath, content, base }
+	}
+
+	/** The open deployed script's unsaved edits, which live only in `liveContent`
+	 * until its pane closes: the path, or undefined when there are none. */
+	get liveEditPath(): string | undefined {
+		const { scriptPath, content, base } = this.liveContent
+		if (scriptPath == undefined || !base || this.drafts.has(scriptPath)) return undefined
+		return content !== (base.content ?? '') ? scriptPath : undefined
+	}
+
+	/** Closes the open pane and waits for its edits to land as a draft, as closing
+	 * it by hand does: what is deployed or discarded next then includes them, and
+	 * no pane is left holding a stale copy. Returns the path the pane was on. */
+	closePane = async (): Promise<string | undefined> => {
+		const path =
+			this.activeDraftPath ?? (this.selection?.kind === 'runnable' ? this.selection.path : undefined)
+		if (this.activeDraftPath === undefined && this.selection === undefined) return undefined
+		this.activeDraftPath = undefined
+		this.selection = undefined
+		// The pane unmounts on the next flush; its save-back commits a microtask later.
+		await tick()
+		await new Promise<void>((resolve) => queueMicrotask(resolve))
+		// Its buffer now lives in the draft; left here, autosave would serialize it
+		// again once that draft is deployed or discarded.
+		this.clearLiveOverlays()
+		return path
 	}
 
 	clearLiveOverlays = () => {
@@ -125,6 +171,72 @@ export class PipelineEditorState {
 		next.delete(path)
 		this.drafts = next
 		this.forgetPath(path)
+		this.discardTriggerDraftsFor(path)
+	}
+
+	/** Summary and labels of a script draft, edited from the pane header. */
+	setDraftMeta = (path: string, meta: { summary: string; labels: string[] | undefined }) => {
+		const d = this.drafts.get(path)
+		if (!d) return
+		this.drafts = new Map(this.drafts).set(path, {
+			...d,
+			script: { ...d.script, summary: meta.summary, labels: meta.labels }
+		})
+	}
+
+	/** Add or replace a trigger draft; `previousKey` is the entry being edited, which
+	 * a rename drops. False, and nothing changes, when the path is another draft's:
+	 * both would deploy to one trigger. */
+	setTriggerDraft = (d: PipelineTriggerDraft, previousKey?: string): boolean => {
+		const key = triggerDraftKey(d.kind, d.config.path)
+		if (key !== previousKey && this.triggerDrafts.has(key)) return false
+		const next = new Map(this.triggerDrafts)
+		if (previousKey) next.delete(previousKey)
+		next.set(key, d)
+		this.triggerDrafts = next
+		return true
+	}
+
+	discardTriggerDraft = (key: string) => {
+		if (!this.triggerDrafts.has(key)) return
+		const next = new Map(this.triggerDrafts)
+		next.delete(key)
+		this.triggerDrafts = next
+	}
+
+	/** A trigger draft cannot outlive the script draft it was configured with:
+	 * deploying it would target a path nothing is deployed at. */
+	discardTriggerDraftsFor = (scriptPath: string) => {
+		const next = new Map(
+			[...this.triggerDrafts].filter(([, d]) => d.config.script_path !== scriptPath)
+		)
+		if (next.size !== this.triggerDrafts.size) this.triggerDrafts = next
+	}
+
+	/** Follow a script draft rename, keeping default `<script>_<kind>` names in step. */
+	/** Returns the trigger path another draft already holds, and changes nothing,
+	 * when a renamed default name would land on it. */
+	retargetTriggerDrafts = (oldScriptPath: string, newScriptPath: string): string | undefined => {
+		const moved = new Map<string, PipelineTriggerDraft>()
+		const kept = new Map<string, PipelineTriggerDraft>()
+		for (const [k, d] of this.triggerDrafts) {
+			if (d.config.script_path !== oldScriptPath) {
+				kept.set(k, d)
+				continue
+			}
+			const path =
+				d.config.path === defaultTriggerPath(oldScriptPath, d.kind)
+					? defaultTriggerPath(newScriptPath, d.kind)
+					: d.config.path
+			moved.set(triggerDraftKey(d.kind, path), {
+				...d,
+				config: { ...d.config, path, script_path: newScriptPath }
+			})
+		}
+		if (moved.size === 0) return undefined
+		for (const [k, d] of moved) if (kept.has(k)) return d.config.path
+		this.triggerDrafts = new Map([...kept, ...moved])
+		return undefined
 	}
 
 	/** Commit body edits + inferred outputs back into the drafts Map on pane
@@ -147,7 +259,7 @@ export class PipelineEditorState {
 				if (!snapshot.script) return
 				const next = new Map(this.drafts)
 				next.set(p, {
-					localId: this.newDraftLocalId(),
+					localId: this.promotedDraftLocalId(p),
 					script: snapshot.script,
 					outputAssets: snapshot.writes.length > 0 ? snapshot.writes : undefined,
 					inputAssets: snapshot.reads
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.test.ts
index 2ec06bc8cc..09cec13a37 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.test.ts
@@ -104,3 +104,72 @@ describe('PipelineEditorState.handleDraftPersist — read capture', () => {
 		expect(pe.drafts.get('f/x/n')?.inputAssets).toBeUndefined()
 	})
 })
+
+describe('PipelineEditorState trigger drafts', () => {
+	it('follow their script draft: renamed with it, discarded with it', () => {
+		const pe = new PipelineEditorState()
+		pe.drafts = new Map([['f/x/n', draft('SELECT 1')]])
+		pe.setTriggerDraft({ kind: 'kafka', config: { path: 'f/x/n_kafka', script_path: 'f/x/n' } })
+		pe.setTriggerDraft({ kind: 'schedule', config: { path: 'f/x/nightly', script_path: 'f/x/n' } })
+
+		pe.retargetTriggerDrafts('f/x/n', 'f/x/m')
+		// A default `<script>_<kind>` name follows the script; a chosen one stays.
+		expect([...pe.triggerDrafts.keys()].sort()).toEqual([
+			'kafka:f/x/m_kafka',
+			'schedule:f/x/nightly'
+		])
+		expect([...pe.triggerDrafts.values()].every((d) => d.config.script_path === 'f/x/m')).toBe(true)
+
+		pe.drafts = new Map([['f/x/m', draft('SELECT 1')]])
+		pe.discardDraft('f/x/m')
+		expect(pe.triggerDrafts.size).toBe(0)
+	})
+
+	it('refuse a path another draft holds, but let a draft keep its own', () => {
+		const pe = new PipelineEditorState()
+		const a = { kind: 'kafka' as const, config: { path: 'f/x/k', script_path: 'f/x/a' } }
+		expect(pe.setTriggerDraft(a)).toBe(true)
+		expect(
+			pe.setTriggerDraft({ kind: 'kafka', config: { path: 'f/x/k', script_path: 'f/x/b' } })
+		).toBe(false)
+		expect(pe.triggerDrafts.get('kafka:f/x/k')?.config.script_path).toBe('f/x/a')
+		expect(pe.setTriggerDraft({ ...a, config: { ...a.config, topics: ['t'] } }, 'kafka:f/x/k')).toBe(
+			true
+		)
+	})
+
+	it('refuse a script rename that moves a default name onto another draft', () => {
+		const pe = new PipelineEditorState()
+		pe.setTriggerDraft({ kind: 'kafka', config: { path: 'f/x/a_kafka', script_path: 'f/x/a' } })
+		pe.setTriggerDraft({ kind: 'kafka', config: { path: 'f/x/b_kafka', script_path: 'f/x/c' } })
+		expect(pe.retargetTriggerDrafts('f/x/a', 'f/x/b')).toBe('f/x/b_kafka')
+		expect([...pe.triggerDrafts.keys()].sort()).toEqual(['kafka:f/x/a_kafka', 'kafka:f/x/b_kafka'])
+	})
+})
+
+describe('PipelineEditorState.liveEditPath', () => {
+	const base = { path: 'f/x/n', language: 'duckdb', content: 'SELECT 1' } as PipelineDraft['script']
+
+	it('counts an open deployed script with unsaved edits, until it has a draft', () => {
+		const pe = new PipelineEditorState()
+		pe.liveContent = { scriptPath: 'f/x/n', content: 'SELECT 1', base }
+		expect(pe.liveEditPath).toBeUndefined()
+		pe.liveContent = { scriptPath: 'f/x/n', content: 'SELECT 2', base }
+		expect(pe.liveEditPath).toBe('f/x/n')
+		pe.drafts = new Map([['f/x/n', draft('SELECT 2')]])
+		expect(pe.liveEditPath).toBeUndefined()
+	})
+})
+
+describe('PipelineEditorState.closePane', () => {
+	it("leaves no open buffer behind for autosave to bring back once the draft is gone", async () => {
+		const pe = new PipelineEditorState()
+		const base = { path: 'f/x/n', language: 'duckdb', content: 'SELECT 1' } as PipelineDraft['script']
+		pe.selection = { kind: 'runnable', runnable_kind: 'script', path: 'f/x/n' }
+		pe.liveContent = { scriptPath: 'f/x/n', content: 'SELECT 2', base }
+		expect(await pe.closePane()).toBe('f/x/n')
+		expect(pe.selection).toBeUndefined()
+		expect(pe.liveEditPath).toBeUndefined()
+		expect(pe.liveContent.scriptPath).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDraftDeploy.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDraftDeploy.ts
new file mode 100644
index 0000000000..3b37ac43a5
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDraftDeploy.ts
@@ -0,0 +1,89 @@
+import { usedTriggerKinds } from '$lib/stores'
+import { formatCron } from '$lib/utils'
+import { saveScheduleFromCfg } from '$lib/components/flows/scheduleUtils'
+import { saveEmailTriggerFromCfg } from '$lib/components/triggers/email/utils'
+import { saveKafkaTriggerFromCfg } from '$lib/components/triggers/kafka/utils'
+import { saveMqttTriggerFromCfg } from '$lib/components/triggers/mqtt/utils'
+import { saveAmqpTriggerFromCfg } from '$lib/components/triggers/amqp/utils'
+import { saveNatsTriggerFromCfg } from '$lib/components/triggers/nats/utils'
+import { savePostgresTriggerFromCfg } from '$lib/components/triggers/postgres/utils'
+import { saveSqsTriggerFromCfg } from '$lib/components/triggers/sqs/utils'
+import { saveGcpTriggerFromCfg } from '$lib/components/triggers/gcp/utils'
+import {
+	AmqpTriggerService,
+	EmailTriggerService,
+	GcpTriggerService,
+	KafkaTriggerService,
+	MqttTriggerService,
+	NatsTriggerService,
+	PostgresTriggerService,
+	ScheduleService,
+	SqsTriggerService
+} from '$lib/gen'
+import type { NativeTriggerKind, PipelineTriggerDraft } from './types'
+
+/** Creates the trigger through the same helper its editor saves with; that helper
+ * reports the outcome as a toast and resolves to whether it succeeded. */
+export function deployTriggerDraft(d: PipelineTriggerDraft, workspace: string): Promise<boolean> {
+	const cfg = d.config
+	switch (d.kind) {
+		case 'schedule':
+			return saveScheduleFromCfg({ ...cfg, schedule: formatCron(cfg.schedule) }, false, workspace)
+		case 'email':
+			return saveEmailTriggerFromCfg('', cfg, false, workspace, false, usedTriggerKinds)
+		case 'kafka':
+			return saveKafkaTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'mqtt':
+			return saveMqttTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'amqp':
+			return saveAmqpTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'nats':
+			return saveNatsTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'postgres':
+			return savePostgresTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'sqs':
+			return saveSqsTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'gcp':
+			return saveGcpTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+	}
+}
+
+/** Deletes a deployed trigger row. False for the kinds that have none (webhook,
+ * data upload). */
+export async function deleteTriggerRow(
+	kind: NativeTriggerKind,
+	path: string,
+	workspace: string
+): Promise<boolean> {
+	switch (kind) {
+		case 'schedule':
+			await ScheduleService.deleteSchedule({ workspace, path })
+			return true
+		case 'kafka':
+			await KafkaTriggerService.deleteKafkaTrigger({ workspace, path })
+			return true
+		case 'mqtt':
+			await MqttTriggerService.deleteMqttTrigger({ workspace, path })
+			return true
+		case 'amqp':
+			await AmqpTriggerService.deleteAmqpTrigger({ workspace, path })
+			return true
+		case 'nats':
+			await NatsTriggerService.deleteNatsTrigger({ workspace, path })
+			return true
+		case 'postgres':
+			await PostgresTriggerService.deletePostgresTrigger({ workspace, path })
+			return true
+		case 'sqs':
+			await SqsTriggerService.deleteSqsTrigger({ workspace, path })
+			return true
+		case 'gcp':
+			await GcpTriggerService.deleteGcpTrigger({ workspace, path })
+			return true
+		case 'email':
+			await EmailTriggerService.deleteEmailTrigger({ workspace, path })
+			return true
+		default:
+			return false
+	}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDrafts.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDrafts.ts
new file mode 100644
index 0000000000..7fd2998923
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDrafts.ts
@@ -0,0 +1,26 @@
+import type { PipelineTriggerDraftKind } from './types'
+
+export const DRAFTABLE_TRIGGER_KINDS: readonly PipelineTriggerDraftKind[] = [
+	'schedule',
+	'email',
+	'kafka',
+	'mqtt',
+	'amqp',
+	'nats',
+	'postgres',
+	'sqs',
+	'gcp'
+]
+
+export function isDraftableTriggerKind(kind: string): kind is PipelineTriggerDraftKind {
+	return (DRAFTABLE_TRIGGER_KINDS as readonly string[]).includes(kind)
+}
+
+/** Drafts are keyed by kind too: two kinds may share a trigger path. */
+export function triggerDraftKey(kind: string, path: string): string {
+	return `${kind}:${path}`
+}
+
+export function defaultTriggerPath(scriptPath: string, kind: PipelineTriggerDraftKind): string {
+	return `${scriptPath}_${kind}`
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts
index c57687d78b..6d38a8c119 100644
--- a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import {
 	resolveGraph,
 	computeMutedReadKeys,
+	pipelineNodeErrors,
 	dbtAssociations,
 	type ResolveGraphInput
 } from './resolveGraph'
@@ -492,6 +493,49 @@ describe('resolveGraph', () => {
 		expect(r.edges.some((e) => e.asset_path === 'main/out' && e.access_type === 'w')).toBe(true)
 	})
 
+	it('drops a persisted asset the open script renamed away, unless something still uses it', () => {
+		const write = (runnable_path: string, asset_path: string) => ({
+			runnable_path,
+			runnable_kind: 'script' as const,
+			asset_kind: 's3object' as const,
+			asset_path,
+			access_type: 'w' as const
+		})
+		const base = baseGraph({
+			assets: [
+				{ kind: 's3object', path: '/old.json' },
+				{ kind: 's3object', path: '/shared.json' },
+				{ kind: 's3object', path: '/unreferenced.json' }
+			],
+			runnables: [
+				{ path: 'f/x/prod', usage_kind: 'script' },
+				{ path: 'f/x/other', usage_kind: 'script' }
+			],
+			edges: [write('f/x/prod', '/old.json'), write('f/x/prod', '/shared.json')],
+			triggers: [
+				{
+					trigger_kind: 'asset',
+					asset_kind: 's3object',
+					asset_path: '/shared.json',
+					runnable_kind: 'script',
+					runnable_path: 'f/x/other'
+				}
+			]
+		})
+		const r = resolveGraph(
+			input({
+				base,
+				liveAnnotations: { scriptPath: 'f/x/prod', annotations: ann() },
+				liveBodyAssets: { scriptPath: 'f/x/prod', assets: [s3('/new.json', 'w')] }
+			})
+		)
+		expect(r.assets.map((a) => a.path).sort()).toEqual([
+			'/new.json',
+			'/shared.json',
+			'/unreferenced.json'
+		])
+	})
+
 	it('editing a saved scd2 producer keeps both the base and _current persisted write edges', () => {
 		// Deploy persists a write to both `main/dim` and `main/dim_current`.
 		// Opening the producer for editing must not judge the companion `_current`
@@ -656,6 +700,31 @@ describe('resolveGraph', () => {
 		})
 	})
 
+	it('a trigger draft stands in for its draft script’s missing trigger of that kind', () => {
+		const drafts = new Map([['f/x/new', { script: { content: '// on schedule\n// on kafka' } }]])
+		const r = resolveGraph(
+			input({
+				drafts,
+				triggerDrafts: [
+					{ kind: 'schedule', config: { path: 'f/x/new_schedule', script_path: 'f/x/new' } }
+				]
+			})
+		)
+		expect(r.triggers.filter((t) => t.trigger_kind === 'kafka')).toEqual([
+			expect.objectContaining({ runnable_path: 'f/x/new', missing: true })
+		])
+		expect(r.triggers.filter((t) => t.trigger_kind === 'schedule')).toEqual([
+			{
+				trigger_kind: 'schedule',
+				path: 'f/x/new_schedule',
+				runnable_kind: 'script',
+				runnable_path: 'f/x/new',
+				unsaved: true,
+				draft: true
+			}
+		])
+	})
+
 	it('macro edges: base passes through; live `// use` adds an unsaved via_use edge', () => {
 		const base = baseGraph({
 			runnables: [
@@ -884,11 +953,11 @@ describe('live buffer overlays (open script)', () => {
 			access_type: 'w',
 			unsaved: true
 		})
-		// …the stale write edge is dropped, but the deployed dataset node stays.
+		// …the stale write edge is dropped, and with nothing else using it, so is the node.
 		expect(
 			r.edges.filter((e) => e.asset_path === 'main/orders' && e.runnable_path === 'f/x/prod')
 		).toEqual([])
-		expect(r.assets).toContainEqual({ kind: 'ducklake', path: 'main/orders' })
+		expect(r.assets).not.toContainEqual({ kind: 'ducklake', path: 'main/orders' })
 	})
 
 	it('open saved script: unchanged materialize target dedups against the persisted write edge', () => {
@@ -1083,9 +1152,7 @@ describe('dbtAssociations', () => {
 	it('counts only what the project materializes as its transforms', () => {
 		const { writesByOwner } = dbtAssociations(runnables, edges)
 		// Hovering the project highlights the models it builds, not its inputs.
-		expect([...(writesByOwner.get('script:f/a/dbtproj') ?? [])]).toEqual([
-			'asset:dbt:wh/s/model_a'
-		])
+		expect([...(writesByOwner.get('script:f/a/dbtproj') ?? [])]).toEqual(['asset:dbt:wh/s/model_a'])
 	})
 
 	it('ignores runnables that are not dbt', () => {
@@ -1162,8 +1229,160 @@ describe('dbtAssociations with two writers of one relation', () => {
 			writeBy('f/a/downstream')
 		])
 		expect(writesByOwner.get('script:f/a/upstream')).toEqual(new Set(['asset:dbt:wh/s/shared']))
-		expect(writesByOwner.get('script:f/a/downstream')).toEqual(
-			new Set(['asset:dbt:wh/s/shared'])
+		expect(writesByOwner.get('script:f/a/downstream')).toEqual(new Set(['asset:dbt:wh/s/shared']))
+	})
+})
+
+describe('pipelineNodeErrors', () => {
+	const edge = (runnable_path: string, asset_path: string, access_type: 'r' | 'w') => ({
+		runnable_path,
+		runnable_kind: 'script' as const,
+		asset_kind: 'ducklake' as const,
+		asset_path,
+		access_type
+	})
+	const graph = baseGraph({
+		assets: [
+			{ kind: 'ducklake', path: 'main/orphan' },
+			{ kind: 'ducklake', path: 'main/produced' },
+			{ kind: 'ducklake', path: 'main/external' }
+		],
+		runnables: [
+			{ path: 'f/x/prod', usage_kind: 'script' },
+			{ path: 'f/x/cons', usage_kind: 'script' }
+		],
+		edges: [
+			edge('f/x/prod', 'main/produced', 'w'),
+			edge('f/x/cons', 'main/produced', 'r'),
+			edge('f/x/cons', 'main/external', 'r')
+		]
+	})
+
+	it('flags an unused asset, and a `// on` with no producer and its script, but not a plain read', () => {
+		const onRefs = (...paths: string[]) =>
+			paths.map((path) => ({ kind: 'ducklake' as const, path }))
+		const none = pipelineNodeErrors(graph, new Map())
+		expect([...none.assets.keys()]).toEqual(['ducklake:main/orphan'])
+		expect(none.scripts.size).toBe(0)
+		const errors = pipelineNodeErrors(
+			graph,
+			new Map([['f/x/cons', onRefs('main/produced', 'main/external')]])
 		)
+		// The subscriber is at fault, not the asset nothing writes.
+		expect([...errors.assets.keys()]).toEqual(['ducklake:main/orphan'])
+		expect([...errors.scripts.keys()]).toEqual(['f/x/cons'])
+		expect([...errors.unwritten.keys()]).toEqual(['ducklake:main/external'])
+	})
+
+	it('flags a pipeline script nothing starts, but not a macro library or a triggered one', () => {
+		const g = baseGraph({
+			runnables: [
+				{ path: 'f/x/stray', usage_kind: 'script', in_pipeline: true },
+				{ path: 'f/x/lib', usage_kind: 'script', in_pipeline: true, macros: [{ name: 'm' }] },
+				{ path: 'f/x/timed', usage_kind: 'script', in_pipeline: true }
+			] as any,
+			triggers: [
+				{
+					trigger_kind: 'schedule',
+					path: 'f/x/timed_schedule',
+					runnable_kind: 'script',
+					runnable_path: 'f/x/timed'
+				}
+			]
+		})
+		expect([...pipelineNodeErrors(g, new Map()).untriggered.keys()]).toEqual(['f/x/stray'])
+	})
+
+	it('flags a script only started by reads of assets nothing writes', () => {
+		const g = baseGraph({
+			assets: [{ kind: 'ducklake', path: 'main/raw' }],
+			runnables: [{ path: 'f/x/reader', usage_kind: 'script', in_pipeline: true }] as any,
+			edges: [
+				{
+					runnable_path: 'f/x/reader',
+					runnable_kind: 'script',
+					asset_kind: 'ducklake',
+					asset_path: 'main/raw',
+					access_type: 'r'
+				}
+			],
+			triggers: [
+				{
+					trigger_kind: 'asset',
+					asset_kind: 'ducklake',
+					asset_path: 'main/raw',
+					runnable_kind: 'script',
+					runnable_path: 'f/x/reader'
+				}
+			]
+		})
+		expect(pipelineNodeErrors(g, new Map()).untriggered.get('f/x/reader')).toBe('unwritten-inputs')
+		expect(
+			pipelineNodeErrors(g, new Map(), new Set(['ducklake:main/raw'])).untriggered.size
+		).toBe(0)
+	})
+
+	it('does not count a flow write as starting an asset-triggered script', () => {
+		const g = baseGraph({
+			assets: [{ kind: 'ducklake', path: 'main/raw' }],
+			runnables: [
+				{ path: 'f/x/reader', usage_kind: 'script', in_pipeline: true },
+				{ path: 'f/x/loader', usage_kind: 'flow' }
+			] as any,
+			edges: [
+				{
+					runnable_path: 'f/x/loader',
+					runnable_kind: 'flow',
+					asset_kind: 'ducklake',
+					asset_path: 'main/raw',
+					access_type: 'w'
+				}
+			],
+			triggers: [
+				{
+					trigger_kind: 'asset',
+					asset_kind: 'ducklake',
+					asset_path: 'main/raw',
+					runnable_kind: 'script',
+					runnable_path: 'f/x/reader'
+				}
+			]
+		} as any)
+		expect(pipelineNodeErrors(g, new Map()).untriggered.get('f/x/reader')).toBe('unwritten-inputs')
+	})
+
+	it('clears a subscription the workspace writes outside the pipeline', () => {
+		const errors = pipelineNodeErrors(
+			graph,
+			new Map([['f/x/cons', [{ kind: 'ducklake' as const, path: 'main/external' }]]]),
+			new Set(['ducklake:main/external'])
+		)
+		expect(errors.scripts.size).toBe(0)
+		expect(errors.unwritten.size).toBe(0)
+	})
+
+	it('treats dbt models as used and written by their (hidden) project, but not dbt sources', () => {
+		const dbt = (path: string, resource_type: string) => ({
+			kind: 'dbt' as const,
+			path,
+			dbt: { unique_id: `x.${path}`, resource_type } as any
+		})
+		const errors = pipelineNodeErrors(
+			baseGraph({
+				assets: [dbt('mart', 'model'), dbt('raw', 'source')],
+				runnables: [{ path: 'f/x/s', usage_kind: 'script' }]
+			}),
+			new Map([
+				[
+					'f/x/s',
+					[
+						{ kind: 'dbt', path: 'mart' },
+						{ kind: 'dbt', path: 'raw' }
+					]
+				]
+			])
+		)
+		expect([...errors.unwritten.keys()]).toEqual(['dbt:raw'])
+		expect([...errors.scripts.keys()]).toEqual(['f/x/s'])
 	})
 })
diff --git a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts
index 5c8aa697a4..b178de3387 100644
--- a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts
@@ -1,4 +1,9 @@
-import type { AssetGraphMacroEdge, AssetGraphResponse, NativeTriggerKind } from './types'
+import type {
+	AssetGraphMacroEdge,
+	AssetGraphResponse,
+	NativeTriggerKind,
+	PipelineTriggerDraft
+} from './types'
 import {
 	mergeColumnLineage,
 	parsePipelineAnnotations,
@@ -46,6 +51,8 @@ export type ResolveGraphInput = {
 	 * annotation has no matching trigger row in `base.triggers`.
 	 */
 	annotatedNativeKindsByPath: Map<string, Set<NativeTriggerKind>>
+	/** Undeployed triggers; each stands in for its script's missing trigger of that kind. */
+	triggerDrafts?: Iterable<PipelineTriggerDraft>
 }
 
 /** Mutable bag the sequential passes accumulate the resolved graph into. */
@@ -264,16 +271,200 @@ export function resolveGraph(input: ResolveGraphInput): AssetGraphResponse {
 	// there is nothing to show (also keeps the no-macros response shape
 	// byte-identical to before the feature).
 	const macroEdges = resolveMacroEdges(input)
+	const triggers = withTriggerDrafts(
+		[...baseTriggers, ...acc.extraTriggers],
+		input.triggerDrafts ?? []
+	)
 	return {
 		...base,
-		assets: acc.assets,
+		assets: dropOrphanedAssets(acc.assets, base, acc.edges, triggers),
 		runnables: acc.runnables,
 		edges: acc.edges,
-		triggers: [...baseTriggers, ...acc.extraTriggers],
+		triggers,
 		...(macroEdges.length > 0 || base.macro_edges ? { macro_edges: macroEdges } : {})
 	}
 }
 
+function withTriggerDrafts(
+	triggers: AssetGraphResponse['triggers'],
+	triggerDrafts: Iterable<PipelineTriggerDraft>
+): AssetGraphResponse['triggers'] {
+	const drafts = [...triggerDrafts]
+	if (drafts.length === 0) return triggers
+	const drafted = new Set(drafts.map((d) => `${d.kind}:${d.config.script_path}`))
+	return [
+		...triggers.filter(
+			(t) =>
+				!(
+					t.trigger_kind !== 'asset' &&
+					t.missing &&
+					t.runnable_kind === 'script' &&
+					drafted.has(`${t.trigger_kind}:${t.runnable_path}`)
+				)
+		),
+		...drafts.map((d) => ({
+			trigger_kind: d.kind,
+			path: d.config.path,
+			runnable_kind: 'script' as const,
+			runnable_path: d.config.script_path,
+			unsaved: true,
+			draft: true,
+			...(d.kind === 'schedule'
+				? { schedule: d.config.schedule as string, timezone: d.config.timezone as string }
+				: {}),
+			...(d.config.summary ? { summary: d.config.summary as string } : {})
+		}))
+	]
+}
+
+/** Why a node is red, and what the Fix actions act on. */
+export type PipelineNodeErrors = {
+	/** `kind:path` → reason. */
+	assets: Map<string, string>
+	/** Script path → reason. */
+	scripts: Map<string, string>
+	/** Subscribed assets nothing writes: `kind:path` → the asset and its subscribers. */
+	unwritten: Map<string, { asset: { kind: AssetKind; path: string }; subscribers: string[] }>
+	/** Script path → the unwritten asset it runs on (its first, when several). */
+	waitsOn: Map<string, { kind: AssetKind; path: string }>
+	/** Pipeline scripts nothing starts → why: no trigger at all, or only asset
+	 * triggers on assets nothing writes (an auto-triggering read included). */
+	untriggered: Map<string, 'no-trigger' | 'unwritten-inputs'>
+	/** Assets some asset trigger waits on that nothing in the pipeline writes: the
+	 * ones to look up across the workspace for `writtenElsewhere`. */
+	unwrittenTriggerAssets: Set<string>
+}
+
+/**
+ * Nodes the pipeline cannot work with, with the reason. Assets (keyed
+ * `kind:path`): one nothing uses at all. Scripts (keyed by path): one
+ * subscribed (`// on <asset>`) to an asset nothing writes, in the pipeline or,
+ * per `writtenElsewhere`, by a script anywhere else in the workspace, since the subscription can never fire; the asset itself is
+ * fine, and is reported in `unwritten`. A body read of an external asset is fine and is not passed here:
+ * only the explicit `// on` annotations, per script path, count as subscriptions.
+ */
+export function pipelineNodeErrors(
+	graph: AssetGraphResponse,
+	explicitOnByPath: Map<string, Array<{ kind: AssetKind; path: string }>>,
+	writtenElsewhere: ReadonlySet<string> = new Set()
+): PipelineNodeErrors {
+	const referenced = referencedAssetKeys(graph)
+	// Only a script's write fires an asset trigger: a flow's never does.
+	const written = new Set(
+		graph.edges
+			.filter(
+				(e) => e.runnable_kind === 'script' && (e.access_type === 'w' || e.access_type === 'rw')
+			)
+			.map((e) => `${e.asset_kind}:${e.asset_path}`)
+	)
+	for (const k of writtenElsewhere) written.add(k)
+	// The dbt project's own edges are hidden from the pipeline graph (see
+	// `hideDbtRunnables`), so its relations are judged by their provenance: the
+	// project uses every one, and materializes all but its sources.
+	for (const a of graph.assets) {
+		if (!a.dbt) continue
+		referenced.add(`${a.kind}:${a.path}`)
+		if (a.dbt.resource_type !== 'source') written.add(`${a.kind}:${a.path}`)
+	}
+	const errors = new Map<string, string>()
+	const scriptErrors = new Map<string, string>()
+	const unwritten: PipelineNodeErrors['unwritten'] = new Map()
+	const waitsOn: PipelineNodeErrors['waitsOn'] = new Map()
+	for (const a of graph.assets) {
+		const key = `${a.kind}:${a.path}`
+		if (!referenced.has(key)) errors.set(key, 'nothing in the pipeline uses it')
+	}
+	const scripts = new Set(
+		graph.runnables.filter((r) => r.usage_kind === 'script').map((r) => r.path)
+	)
+	for (const [path, refs] of explicitOnByPath) {
+		if (!scripts.has(path)) continue
+		for (const ref of refs) {
+			const key = `${ref.kind}:${ref.path}`
+			if (written.has(key)) continue
+			const entry = unwritten.get(key) ?? { asset: ref, subscribers: [] }
+			if (!entry.subscribers.includes(path)) entry.subscribers.push(path)
+			unwritten.set(key, entry)
+			if (!scriptErrors.has(path)) {
+				scriptErrors.set(path, `runs on ${ref.path}, which nothing writes`)
+				waitsOn.set(path, ref)
+			}
+		}
+	}
+	// A pipeline script nothing starts runs only by hand. An asset trigger starts
+	// it only if something writes that asset, which covers the automatic trigger
+	// of a ducklake/s3 read too. dbt projects and macro libraries are never
+	// started on their own, so they are left out.
+	const assetKey = (t: { asset_kind: AssetKind; asset_path: string }) =>
+		`${t.asset_kind}:${t.asset_path}`
+	const unwrittenTriggerAssets = new Set<string>()
+	const hasTrigger = new Set<string>()
+	const started = new Set<string>()
+	for (const t of graph.triggers) {
+		hasTrigger.add(t.runnable_path)
+		if (t.trigger_kind !== 'asset') started.add(t.runnable_path)
+		else if (written.has(assetKey(t))) started.add(t.runnable_path)
+		else unwrittenTriggerAssets.add(assetKey(t))
+	}
+	for (const k of unwritten.keys()) unwrittenTriggerAssets.add(k)
+	const untriggered: PipelineNodeErrors['untriggered'] = new Map()
+	for (const r of graph.runnables) {
+		if (r.usage_kind !== 'script' || !r.in_pipeline || r.dbt || r.macros?.length) continue
+		if (started.has(r.path) || scriptErrors.has(r.path)) continue
+		const why = hasTrigger.has(r.path) ? 'unwritten-inputs' : 'no-trigger'
+		untriggered.set(r.path, why)
+		scriptErrors.set(
+			r.path,
+			why === 'no-trigger'
+				? 'nothing starts it: it has no trigger'
+				: 'nothing starts it: nothing writes the assets it runs after'
+		)
+	}
+	return {
+		assets: errors,
+		scripts: scriptErrors,
+		unwritten,
+		waitsOn,
+		untriggered,
+		unwrittenTriggerAssets
+	}
+}
+
+function referencedAssetKeys(
+	graph: Pick<AssetGraphResponse, 'edges' | 'triggers' | 'test_edges' | 'dbt_edges'>
+): Set<string> {
+	const keys = new Set<string>()
+	for (const e of graph.edges) keys.add(`${e.asset_kind}:${e.asset_path}`)
+	for (const t of graph.triggers)
+		if (t.trigger_kind === 'asset') keys.add(`${t.asset_kind}:${t.asset_path}`)
+	for (const e of graph.test_edges ?? []) keys.add(`${e.asset_kind}:${e.asset_path}`)
+	for (const e of graph.dbt_edges ?? []) {
+		keys.add(`dbt:${e.from_asset_path}`)
+		keys.add(`dbt:${e.to_asset_path}`)
+	}
+	return keys
+}
+
+/**
+ * The backend only returns assets something references, so a deployed asset
+ * whose every edge and trigger the draft/live overlays stripped — an output the
+ * open script renamed — would linger as an edgeless node until the deploy
+ * lands. Assets that were already unreferenced in `base` are left alone.
+ */
+function dropOrphanedAssets(
+	assets: AssetGraphResponse['assets'],
+	base: AssetGraphResponse,
+	edges: AssetGraphResponse['edges'],
+	triggers: AssetGraphResponse['triggers']
+): AssetGraphResponse['assets'] {
+	const before = referencedAssetKeys(base)
+	const after = referencedAssetKeys({ ...base, edges, triggers })
+	return assets.filter((a) => {
+		const key = `${a.kind}:${a.path}`
+		return !before.has(key) || after.has(key)
+	})
+}
+
 /**
  * Macro-library → consumer edges: the deployed base edges, with `// use`
  * declarations of overlaid scripts (drafts + the open buffer) taking over
@@ -848,7 +1039,6 @@ function overlayInferredLineage(acc: Accumulator, input: ResolveGraphInput) {
 	overlayLineage(inferredReadsByPath, 'r')
 }
 
-
 /** dbt project ↔ relation association, for a graph that does NOT draw it.
  *
  * A dbt script owns every relation of its project, so drawing one edge per
diff --git a/frontend/src/lib/components/assets/AssetGraph/types.ts b/frontend/src/lib/components/assets/AssetGraph/types.ts
index 023f71e218..4ee7aa0216 100644
--- a/frontend/src/lib/components/assets/AssetGraph/types.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/types.ts
@@ -6,6 +6,12 @@ export type GraphUsageKind = 'script' | 'flow'
 export interface AssetGraphAssetNode {
 	kind: AssetKind
 	path: string
+	// Filled in client-side: the node is misconfigured (see `pipelineNodeErrors`).
+	error?: string
+	// Filled in client-side: no script in the workspace writes it, so a step
+	// downstream of it would never run on its writes (a flow's write fires no
+	// asset trigger).
+	never_written?: boolean
 	// Fork workspaces only: 'fork' when this ducklake asset was materialized in
 	// the fork itself, 'deferred' when reads fall back to the parent workspace's
 	// current table via a defer view. Absent outside forks / for other kinds /
@@ -70,6 +76,12 @@ export interface DbtDataTest {
 export interface AssetGraphRunnableNode {
 	path: string
 	usage_kind: GraphUsageKind
+	// Filled in client-side (not sent by the backend): the canvas titles the
+	// node with the summary over the path, and shows the language's icon.
+	summary?: string
+	language?: import('$lib/gen').ScriptLang
+	// Why the script is misconfigured, when it is (see `pipelineNodeErrors`).
+	error?: string
 	// Script has `// pipeline` annotation. Drives the pipeline-member
 	// visual state; unrelated to what the script actually writes (that's
 	// parsed separately into lineage edges).
@@ -170,6 +182,17 @@ export type NativeTriggerKind =
 	| 'gcp'
 	| 'data_upload'
 
+export type PipelineTriggerDraftKind = Exclude<NativeTriggerKind, 'webhook' | 'data_upload'>
+
+/** A trigger configured in the pipeline editor but not deployed yet. It lives only
+ * in the pipeline's draft bundle, never as a workspace trigger draft, and is
+ * created when the pipeline is saved. `config` is what the kind's editor saves
+ * (for a schedule, a `NewSchedule`). */
+export type PipelineTriggerDraft = {
+	kind: PipelineTriggerDraftKind
+	config: Record<string, any> & { path: string; script_path: string }
+}
+
 export type AssetGraphTrigger =
 	| {
 			trigger_kind: 'asset'
@@ -192,6 +215,13 @@ export type AssetGraphTrigger =
 			// the canvas renders a red placeholder with a "Create trigger"
 			// affordance instead of a fully-wired source.
 			missing?: boolean
+			// A pipeline-local `PipelineTriggerDraft`: `path` is the trigger it
+			// will be deployed as, and no row exists yet.
+			draft?: boolean
+			// A schedule's cron, zone and summary, filled in client-side, for the node's labels.
+			schedule?: string
+			timezone?: string
+			summary?: string
 	  }
 
 // Macro-library → consumer edge: the consumer calls `macro_names` of
diff --git a/frontend/src/lib/components/assets/AssetGraph/upstreamScriptItems.ts b/frontend/src/lib/components/assets/AssetGraph/upstreamScriptItems.ts
new file mode 100644
index 0000000000..43090adb48
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/upstreamScriptItems.ts
@@ -0,0 +1,32 @@
+import type { Item } from '$lib/utils'
+import type { ScriptLang } from '$lib/gen'
+import LanguageIcon from '$lib/components/common/languageIcons/LanguageIcon.svelte'
+import { Code2 } from 'lucide-svelte'
+
+export type UpstreamScript = { path: string; summary?: string; language?: ScriptLang }
+
+/** A menu of the scripts that produce an asset, to pick the one to open. */
+export function upstreamScriptItems(
+	scripts: UpstreamScript[],
+	onPick: (path: string) => void
+): Item[] {
+	return scripts.map((s) => ({
+		displayName: s.summary || s.path,
+		description: s.summary ? s.path : undefined,
+		...(s.language
+			? { icon: LanguageIcon, iconProps: { lang: s.language, width: 14, height: 14 } }
+			: { icon: Code2 }),
+		action: () => onPick(s.path)
+	}))
+}
+
+/** An upstream trigger the asset pane can open, and how. */
+export type UpstreamTriggerAction = { label: string; detail?: string; onOpen: () => void }
+
+export function upstreamTriggerItems(triggers: UpstreamTriggerAction[]): Item[] {
+	return triggers.map((t) => ({
+		displayName: t.label,
+		description: t.detail,
+		action: () => t.onOpen()
+	}))
+}
diff --git a/frontend/src/lib/components/auditLogs/AuditLogMobileFilters.svelte b/frontend/src/lib/components/auditLogs/AuditLogMobileFilters.svelte
index f1c123bb11..f3d84f872b 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogMobileFilters.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogMobileFilters.svelte
@@ -14,7 +14,7 @@
 	contentClasses="p-4 flex flex-col w-80 pt-8 bg-surface"
 >
 	{#snippet trigger()}
-		<Button variant="accent" unifiedSize="md" nonCaptureEvent={true} startIcon={{ icon: Filter }}>
+		<Button variant="accent" unifiedSize="sm" nonCaptureEvent={true} startIcon={{ icon: Filter }}>
 			Filters
 		</Button>
 	{/snippet}
diff --git a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
index 9817b667f7..e2e502b30c 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
@@ -18,7 +18,10 @@
 	import type { ActionKind } from '$lib/common'
 
 	import Button from '$lib/components/common/button/Button.svelte'
-	import CalendarPicker from '$lib/components/common/calendarPicker/CalendarPicker.svelte'
+	import TimeframeSelect, {
+		auditTimeframes,
+		useSyncedTimeframe
+	} from '$lib/components/runs/TimeframeSelect.svelte'
 	import {
 		type AuditLog,
 		ResourceService,
@@ -29,7 +32,7 @@
 	} from '$lib/gen'
 
 	import { userStore, workspaceStore } from '$lib/stores'
-	import { ChevronDown, Download, Loader2, RefreshCcw } from 'lucide-svelte'
+	import { ChevronDown, Download } from 'lucide-svelte'
 	import { onDestroy, onMount, untrack } from 'svelte'
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
@@ -52,7 +55,7 @@
 		actionKind?: ActionKind | 'all'
 		scope?: undefined | 'all_workspaces' | 'instance'
 		loading?: boolean
-		/** Lay the filters out in a row (page header) rather than stacked (popover). */
+		/** Lay the filters out in a row (the page header band) rather than stacked (the popover). */
 		inline?: boolean
 		onRefresh?: () => void
 	}
@@ -265,12 +268,35 @@
 		;[username, perPage, before, after, operation, resource, actionKind, scope]
 		untrack(() => updateQueryParams())
 	})
+
+	// The bounds stay the filters' own `after`/`before`, because the timeline's zoom writes them
+	// too; picking a preset resolves it to a concrete pair here rather than keeping a label that
+	// the chart could then contradict.
+	const _timeframe = useSyncedTimeframe(
+		auditTimeframes,
+		() => ({ minTs: after, maxTs: before }),
+		(v) => {
+			const { minTs, maxTs } = v.timeframe
+				? (auditTimeframes.find((t) => t.label === v.timeframe)?.computeMinMax() ?? {
+						minTs: null,
+						maxTs: null
+					})
+				: { minTs: v.minTs ?? null, maxTs: v.maxTs ?? null }
+			after = minTs ?? undefined
+			before = maxTs ?? undefined
+		}
+	)
 </script>
 
-<div class={inline ? 'flex flex-row gap-2' : 'flex flex-col gap-8 mt-4 xl:mt-0'}>
+<!-- No labels above the controls: each one says what it filters while it is unset ("all usernames"),
+     and once it is set the value names the field by itself. That halves the row's height, which is
+     what lets it sit in the header band, and halves its width, which is what lets it stay there.
+     `inline` rather than a breakpoint: the caller measures whether the row fits the width the band
+     leaves it, which a media query cannot see — the sidebar, a side panel and the filters' own
+     values all move that width without moving the viewport's. -->
+<div class={inline ? 'flex flex-row gap-2 items-center pr-2' : 'flex flex-col gap-2'}>
 	{#if $workspaceStore == 'admins'}
-		<div class="flex gap-1 relative">
-			<span class="text-xs absolute font-semibold text-emphasis -top-4">Scope</span>
+		<div class="flex min-w-0 shrink-0">
 			<ToggleButtonGroup
 				selected={scope ?? 'admins'}
 				on:selected={({ detail }) => {
@@ -300,49 +326,31 @@
 			</ToggleButtonGroup>
 		</div>
 	{/if}
-	<div class="flex relative bg-surface-input">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">From</span>
-		<input type="text" value={after ?? 'From'} disabled />
-		<CalendarPicker
-			clearable
-			date={after}
-			placement="bottom-end"
-			label="From"
-			on:change={({ detail }) => {
-				after = new Date(detail).toISOString()
-			}}
-			on:clear={() => {
-				after = undefined
-			}}
-		/>
-	</div>
-	<div class="flex relative bg-surface-input">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">To</span>
-		<input type="text" value={before ?? 'To'} disabled />
-		<CalendarPicker
-			clearable
-			bind:date={before}
-			label="To"
-			placement="bottom-end"
-			on:change={({ detail }) => {
-				before = new Date(detail).toISOString()
-			}}
-			on:clear={() => {
-				before = undefined
-			}}
-		/>
-	</div>
+	<!-- The same control the runs page uses: presets and a two-calendar range in one popover,
+	     in place of the two date fields this row used to carry. -->
+	<TimeframeSelect
+		unifiedSize="sm"
+		items={auditTimeframes}
+		bind:value={_timeframe.val}
+		{loading}
+		wrapperClasses="shrink-0"
+		onClick={() => {
+			loadUsers()
+			resources.refresh()
+			onRefresh?.()
+		}}
+	/>
 
-	<div class="flex relative">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">Username</span>
+	<div class="w-40 min-w-0 shrink">
 		<Select
 			class="w-full"
+			size="sm"
 			bind:value={username}
 			RightIcon={ChevronDown}
 			items={usernames
 				? [
 						...($userStore?.is_admin || $userStore?.is_super_admin
-							? [{ value: 'all', label: 'all' }]
+							? [{ value: 'all', label: 'all usernames' }]
 							: []),
 						...usernames.map((e) => ({
 							value: e,
@@ -353,41 +361,41 @@
 				: []}
 		/>
 	</div>
-	<div class="flex relative">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">Resource</span>
-
+	<div class="w-40 min-w-0 shrink">
 		<Select
 			class="w-full"
+			size="sm"
 			onCreateItem={(r) => (resources.value?.push(r), (resource = r))}
 			createText="Press enter to use this value"
 			bind:value={resource}
-			items={safeSelectItems(['all', ...(resources.value ?? [])])}
+			items={[{ value: 'all', label: 'all resources' }, ...safeSelectItems(resources.value ?? [])]}
 			inputClass="dark:!bg-gray-700"
 			RightIcon={ChevronDown}
 		/>
 	</div>
 
-	<div class="flex relative">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">Operation</span>
-
+	<div class="w-40 min-w-0 shrink">
 		<Select
 			class="w-full"
+			size="sm"
 			bind:value={operation}
-			items={['all', ...Object.values(operations)].map((r) => ({ value: r, label: r }))}
+			items={[
+				{ value: 'all', label: 'all operations' },
+				...Object.values(operations).map((r) => ({ value: r, label: r }))
+			]}
 			inputClass="dark:!bg-gray-700"
 			RightIcon={ChevronDown}
 		/>
 	</div>
 
-	<div class="flex relative">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">Action</span>
-
+	<div class="w-36 min-w-0 shrink">
 		<Select
 			class="w-full"
+			size="sm"
 			bind:value={actionKind}
 			RightIcon={ChevronDown}
 			items={[
-				{ value: 'all', label: 'all' },
+				{ value: 'all', label: 'all actions' },
 				{ value: 'create', label: 'Create' },
 				{ value: 'update', label: 'Update' },
 				{ value: 'delete', label: 'Delete' },
@@ -396,7 +404,7 @@
 		/>
 	</div>
 
-	<div class="flex flex-row">
+	<div class="flex flex-row items-center gap-1">
 		<Button
 			variant="subtle"
 			on:click={() => {
@@ -409,36 +417,17 @@
 				resource = 'all'
 				scope = undefined
 			}}
-			unifiedSize="md"
+			unifiedSize="sm"
 		>
 			Clear filters
 		</Button>
 		<Button
 			variant="subtle"
 			on:click={downloadAuditLogsAsJson}
-			unifiedSize="md"
+			unifiedSize="sm"
 			title="Downloads currently displayed logs only (up to {perPage} entries)"
 			startIcon={{ icon: Download }}
 			iconOnly
 		/>
-		<Button
-			variant="accent"
-			on:click={() => {
-				loadUsers()
-				resources.refresh()
-				onRefresh?.()
-			}}
-			unifiedSize="md"
-			wrapperClasses="ml-auto"
-		>
-			<div class="flex flex-row gap-1 items-center">
-				{#if loading}
-					<Loader2 size={14} class="animate-spin" />
-				{:else}
-					<RefreshCcw size={14} />
-				{/if}
-				Refresh
-			</div>
-		</Button>
 	</div>
 </div>
diff --git a/frontend/src/lib/components/breadcrumbPath.test.ts b/frontend/src/lib/components/breadcrumbPath.test.ts
new file mode 100644
index 0000000000..427b153800
--- /dev/null
+++ b/frontend/src/lib/components/breadcrumbPath.test.ts
@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest'
+import { splitItemPath } from './breadcrumbPath'
+
+describe('splitItemPath', () => {
+	it('walks the scope, each subfolder, then the item, each with its cumulative path', () => {
+		expect(splitItemPath('f/demo/sub/weather_report')).toEqual({
+			dirs: [
+				{ name: 'f/demo', fullPath: 'f/demo' },
+				{ name: 'sub', fullPath: 'f/demo/sub' }
+			],
+			leaf: { name: 'weather_report', fullPath: 'f/demo/sub/weather_report' }
+		})
+	})
+
+	it('gives up before there is a scope', () => {
+		expect(splitItemPath('f/demo')).toBeUndefined()
+	})
+
+	it('keeps the folders while the name is still being typed', () => {
+		// The editor binds the path live, so every keystroke reaches the breadcrumb: the trail must
+		// not drop out and come back on the first character of the name.
+		expect(splitItemPath('f/demo/')).toEqual({
+			dirs: [{ name: 'f/demo', fullPath: 'f/demo' }],
+			leaf: undefined
+		})
+	})
+})
diff --git a/frontend/src/lib/components/breadcrumbPath.ts b/frontend/src/lib/components/breadcrumbPath.ts
new file mode 100644
index 0000000000..880d558360
--- /dev/null
+++ b/frontend/src/lib/components/breadcrumbPath.ts
@@ -0,0 +1,30 @@
+/** A directory level of an item's path, with the full path down to it. */
+export type PathDir = { name: string; fullPath: string }
+
+/**
+ * Splits `f/demo/weather_report` into the levels a breadcrumb walks: the scope (`f/<folder>` or
+ * `u/<user>`), then each subfolder, then the item itself. Each level carries the cumulative path,
+ * which is what the picker opens and highlights.
+ *
+ * Returns undefined before there is even a scope. The leaf is undefined while the path names a
+ * folder but no item yet (`f/demo/`) — the levels it does name still come back.
+ */
+export function splitItemPath(
+	path: string
+): { dirs: PathDir[]; leaf: PathDir | undefined } | undefined {
+	const parts = path.split('/')
+	if (parts.length < 3) return undefined
+	const scope = parts.slice(0, 2).join('/')
+	const slug = parts.slice(2)
+	const dirs: PathDir[] = [{ name: scope, fullPath: scope }]
+	let acc = scope
+	for (let i = 0; i < slug.length - 1; i++) {
+		acc = `${acc}/${slug[i]}`
+		dirs.push({ name: slug[i], fullPath: acc })
+	}
+	// A leaf with an empty name draws a blank segment. The editor binds the path live, so the
+	// breadcrumb sees every keystroke: the folders stay put while the name is being typed rather
+	// than the whole trail dropping out and coming back.
+	const name = slug[slug.length - 1]
+	return { dirs, leaf: name ? { name, fullPath: path } : undefined }
+}
diff --git a/frontend/src/lib/components/common/alert/Alert.svelte b/frontend/src/lib/components/common/alert/Alert.svelte
index 7d22320867..b7639e1104 100644
--- a/frontend/src/lib/components/common/alert/Alert.svelte
+++ b/frontend/src/lib/components/common/alert/Alert.svelte
@@ -17,6 +17,8 @@
 		bgClass?: string | undefined
 		bgStyle?: string | undefined
 		iconClass?: string | undefined
+		/** Drop the type's icon; the text starts at the alert's edge. */
+		hideIcon?: boolean
 		iconStyle?: string | undefined
 		titleClass?: string | undefined
 		titleStyle?: string | undefined
@@ -41,6 +43,7 @@
 		bgClass = undefined,
 		bgStyle = undefined,
 		iconClass = undefined,
+		hideIcon = false,
 		iconStyle = undefined,
 		titleClass = undefined,
 		titleStyle = undefined,
@@ -78,14 +81,16 @@
 	<div class="flex flex-row items-center">
 		<!-- shrink-0: the badge's min-content width is the 16px icon, so without it a
 		     narrow container squeezes the circle into an oval. -->
-		<div class="flex h-8 w-8 shrink-0 items-center justify-center rounded-full">
-			<SvelteComponent
-				class={twMerge(classes[type].iconClass, iconClass)}
-				style={iconStyle}
-				size={16}
-			/>
-		</div>
-		<div class={twMerge('ml-1 w-full')}>
+		{#if !hideIcon}
+			<div class="flex h-8 w-8 shrink-0 items-center justify-center rounded-full">
+				<SvelteComponent
+					class={twMerge(classes[type].iconClass, iconClass)}
+					style={iconStyle}
+					size={16}
+				/>
+			</div>
+		{/if}
+		<div class={twMerge(!hideIcon && 'ml-1', 'w-full')}>
 			{#if hasTitleRow}
 				<div class={twMerge('w-full flex flex-row items-center justify-between')}>
 					<span
diff --git a/frontend/src/lib/components/common/badge/Badge.svelte b/frontend/src/lib/components/common/badge/Badge.svelte
index 515e7d4525..5636f2008c 100644
--- a/frontend/src/lib/components/common/badge/Badge.svelte
+++ b/frontend/src/lib/components/common/badge/Badge.svelte
@@ -87,7 +87,8 @@
 		['dark-indigo']: 'bg-indigo-700 text-indigo-100 dark:bg-indigo-800 dark:text-indigo-200',
 		['dark-orange']: 'bg-orange-700 text-orange-100 dark:bg-orange-800 dark:text-orange-200',
 		['dark-violet']: 'bg-violet-700 text-violet-100 dark:bg-violet-800 dark:text-violet-200',
-		transparent: 'bg-surface-accent-selected text-accent border-gray-400 dark:border-gray-500'
+		// Keeps the unselected chip's border, so selecting one does not change its height.
+		transparent: 'bg-surface-accent-selected text-accent border border-surface-accent-selected'
 	}
 
 	const hovers: Partial<Record<BadgeColor, string>> = {
diff --git a/frontend/src/lib/components/common/button/Button.svelte b/frontend/src/lib/components/common/button/Button.svelte
index f684d79a9f..f3cfc78478 100644
--- a/frontend/src/lib/components/common/button/Button.svelte
+++ b/frontend/src/lib/components/common/button/Button.svelte
@@ -148,6 +148,13 @@
 	}: Props = $props()
 
 	const activeTone = $derived(dropdownItems ? undefined : tone)
+	// `dropdownItems` may be a function, whose `.length` is its arity — 0 for the `() => [...]`
+	// every caller writes. Asking it for its items is the only way to know whether there are any,
+	// and a split button that answers `.length` instead renders no caret at all.
+	const hasDropdown = $derived(
+		!!dropdownItems &&
+			(typeof dropdownItems === 'function' ? dropdownItems().length : dropdownItems.length) > 0
+	)
 
 	function computeDropdowns(menuItems: MenuItem[] | (() => MenuItem[])): Item[] {
 		const items = typeof menuItems === 'function' ? menuItems() : menuItems
@@ -197,12 +204,7 @@
 						]
 					: ButtonType.VariantStyles[variant]
 			// For default variant with dropdowns, remove border from button since it's on wrapper
-			if (
-				variant === 'default' &&
-				dropdownItems &&
-				((typeof dropdownItems === 'function' && dropdownItems().length > 0) ||
-					dropdownItems.length > 0)
-			) {
+			if (variant === 'default' && hasDropdown) {
 				style = style.replace('border border-border-light', '')
 			}
 			return style
@@ -278,7 +280,7 @@
 			getSpacingClass(variant, size, spacingSize, iconOnly, unifiedSize, extendedSize),
 			unifiedSize ? ButtonType.UnifiedFontSizes[unifiedSize] : '',
 			'focus-visible:ring-2',
-			dropdownItems && dropdownItems.length > 0 ? 'rounded-l-md' : 'rounded-md',
+			hasDropdown ? 'rounded-l-md' : 'rounded-md',
 			'justify-center items-center text-center inline-flex gap-2',
 			'active:opacity-80 transition-[background-color,opacity] duration-150',
 			disabled
@@ -345,7 +347,7 @@
 
 <div
 	class={twMerge(
-		dropdownItems && dropdownItems.length > 0 ? dividerClass : '',
+		hasDropdown ? dividerClass : '',
 		'shrink-0',
 		wrapperClasses,
 		'flex flex-row rounded-md',
@@ -385,6 +387,7 @@
 			class={buttonClass}
 			{id}
 			{target}
+			{title}
 			tabindex={disabled ? -1 : 0}
 			{...rest}
 			{style}
@@ -484,7 +487,7 @@
 		{/if}
 	{/if}
 
-	{#if dropdownItems && dropdownItems.length > 0}
+	{#if hasDropdown && dropdownItems}
 		<Dropdown
 			aiId={aiId ? `${aiId}-dropdown` : undefined}
 			aiDescription={aiDescription ? `${aiDescription} dropdown` : undefined}
diff --git a/frontend/src/lib/components/common/button/model.ts b/frontend/src/lib/components/common/button/model.ts
index 8497ab1a87..c40e0b5b29 100644
--- a/frontend/src/lib/components/common/button/model.ts
+++ b/frontend/src/lib/components/common/button/model.ts
@@ -264,7 +264,9 @@ export namespace ButtonType {
 	export const UnifiedSizingClasses: Record<ButtonType.UnifiedSize, string> = {
 		'2xs': 'px-1', // Compact horizontal padding
 		xs: 'px-2',
-		sm: 'px-2', // Regular horizontal padding
+		// One step of its own rather than sharing xs's: sm is the size a page's header buttons are,
+		// where a label needs room to read as a button rather than as text with a box around it.
+		sm: 'px-3',
 		md: 'px-4',
 		lg: 'px-6'
 	}
diff --git a/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte b/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
index 524817ba34..4b419536fc 100644
--- a/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
@@ -29,6 +29,8 @@
 		 * up confines it. Off by default: it moves the dialog out of its DOM position, so opt
 		 * in per call site rather than assuming every caller wants it. */
 		alwaysPortal?: boolean
+		/** For a notice with nothing to decide: the confirm button is the only one. */
+		hideCancel?: boolean
 		children?: Snippet
 		onConfirmed?: () => void | Promise<void>
 		onCanceled?: () => void
@@ -47,6 +49,7 @@
 		trashbin = false,
 		zIndexClass = 'z-[9999]',
 		alwaysPortal = false,
+		hideCancel = false,
 		children,
 		onConfirmed,
 		onCanceled
@@ -228,15 +231,17 @@
 								{/if}
 								<span class="min-w-20">{confirmationText} </span>
 							</Button>
-							<Button
-								disabled={loading}
-								on:click={() => (dispatch('canceled'), onCanceled?.())}
-								variant="default"
-								size="sm"
-								shortCut={{ key: 'Esc', hide: !keyListen, withoutModifier: true }}
-							>
-								Cancel
-							</Button>
+							{#if !hideCancel}
+								<Button
+									disabled={loading}
+									on:click={() => (dispatch('canceled'), onCanceled?.())}
+									variant="default"
+									size="sm"
+									shortCut={{ key: 'Esc', hide: !keyListen, withoutModifier: true }}
+								>
+									Cancel
+								</Button>
+							{/if}
 						</div>
 					</div>
 				</div>
diff --git a/frontend/src/lib/components/common/contextmenu/fromMenuItems.ts b/frontend/src/lib/components/common/contextmenu/fromMenuItems.ts
new file mode 100644
index 0000000000..1ba6c0bac8
--- /dev/null
+++ b/frontend/src/lib/components/common/contextmenu/fromMenuItems.ts
@@ -0,0 +1,18 @@
+import type { Item } from '$lib/utils'
+import type { ContextMenuItem } from './ContextMenu.svelte'
+
+/** A dropdown's items as the same entries of a right-click menu. */
+export function contextMenuItemsFromMenu(items: Item[]): ContextMenuItem[] {
+	return items.flatMap((item) => [
+		...(item.separatorTop ? [{ id: `${item.displayName}-divider`, label: '', divider: true }] : []),
+		{
+			id: item.displayName,
+			label: item.displayName,
+			icon: item.icon,
+			disabled: item.disabled,
+			type: item.type,
+			shortcut: item.shortcut,
+			onClick: item.action as (() => void) | undefined
+		}
+	])
+}
diff --git a/frontend/src/lib/components/common/drawer/Disposable.svelte b/frontend/src/lib/components/common/drawer/Disposable.svelte
index 886c14042b..4fd472729f 100644
--- a/frontend/src/lib/components/common/drawer/Disposable.svelte
+++ b/frontend/src/lib/components/common/drawer/Disposable.svelte
@@ -32,6 +32,9 @@
 		children?: import('svelte').Snippet<[any]>
 		onOpen?: () => void
 		onClose?: () => void
+		/** Asked before a click away or Escape closes it; resolving false keeps it open, e.g. to
+		 *  confirm discarding unsaved changes. */
+		confirmClose?: () => boolean | Promise<boolean>
 	}
 
 	let {
@@ -42,9 +45,25 @@
 		minZIndex = 0,
 		children,
 		onOpen,
-		onClose
+		onClose,
+		confirmClose
 	}: Props = $props()
 
+	// While the question is on screen, the keys and clicks are its own.
+	let confirming = false
+	async function requestClose() {
+		if (confirming) return
+		if (confirmClose) {
+			confirming = true
+			try {
+				if (!(await confirmClose())) return
+			} finally {
+				confirming = false
+			}
+		}
+		closeDrawer()
+	}
+
 	let offset = $state(untrack(() => initialOffset))
 	// Note: when a Modal with minZIndex is open, all disposables (including
 	// already-open Drawers) are elevated. This is acceptable — relative
@@ -115,7 +134,7 @@
 		const last = stack.val[stack.val.length - 1]
 		if (last === id) {
 			e.stopPropagation()
-			closeDrawer()
+			requestClose()
 		}
 	}
 
@@ -125,7 +144,16 @@
 		if (open) {
 			switch (event.key) {
 				case 'Escape':
+					// The confirmation on screen answers this Escape itself, as its Cancel.
+					if (confirming) break
 					if ((id == stack.val[stack.val.length - 1] || stack.val.length == 0) && !preventEscape) {
+						if (confirmClose) {
+							event.preventDefault()
+							event.stopPropagation()
+							event.stopImmediatePropagation()
+							requestClose()
+							break
+						}
 						stack.val.pop()
 						event.preventDefault()
 						event.stopPropagation()
diff --git a/frontend/src/lib/components/common/drawer/Drawer.svelte b/frontend/src/lib/components/common/drawer/Drawer.svelte
index 76502735ca..45cf99c7be 100644
--- a/frontend/src/lib/components/common/drawer/Drawer.svelte
+++ b/frontend/src/lib/components/common/drawer/Drawer.svelte
@@ -28,6 +28,8 @@
 		positionClass?: string | undefined
 		name?: string
 		children?: import('svelte').Snippet<[any]>
+		/** Asked before a click away or Escape closes it; resolving false keeps it open. */
+		confirmClose?: () => boolean | Promise<boolean>
 	}
 
 	let {
@@ -43,7 +45,8 @@
 		class: clazz = '',
 		positionClass = undefined,
 		name = undefined,
-		children: children_render
+		children: children_render,
+		confirmClose
 	}: Props = $props()
 
 	if (open === undefined) {
@@ -146,6 +149,7 @@
 		onOpen={() => dispatch('open')}
 		onClose={() => dispatch('close')}
 		{preventEscape}
+		{confirmClose}
 	>
 		{#snippet children({ handleClickAway, zIndex, isTop })}
 			<aside
diff --git a/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte b/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte
index 617f5206dc..7635b900bb 100644
--- a/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte
+++ b/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte
@@ -28,6 +28,7 @@
 	import RIcon from '$lib/components/icons/RIcon.svelte'
 	import ClaudeIcon from '$lib/components/icons/ClaudeIcon.svelte'
 	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
+	import { Pi } from 'lucide-svelte'
 
 	interface Props {
 		lang:
@@ -41,6 +42,7 @@
 			| 'powershell'
 			| 'bunnative'
 			| 'claudesandbox'
+			| 'pisandbox'
 		width?: number
 		height?: number
 		scale?: number
@@ -50,7 +52,10 @@
 
 	let { lang, width = 30, height = 30, scale = 1, size = undefined, ...rest }: Props = $props()
 
-	const languageLabel: Record<Script['language'] | 'bunnative' | 'claudesandbox', String> = {
+	const languageLabel: Record<
+		Script['language'] | 'bunnative' | 'claudesandbox' | 'pisandbox',
+		String
+	> = {
 		python3: 'Python',
 		deno: 'TypeScript',
 		go: 'Go',
@@ -76,12 +81,21 @@
 		ruby: 'Ruby',
 		rlang: 'R',
 		dbt: 'dbt',
-		claudesandbox: 'Claude Sandbox'
+		claudesandbox: 'Claude Sandbox',
+		pisandbox: 'Pi Sandbox'
 		// for related places search: ADD_NEW_LANG
 	}
 
 	const langToComponent: Record<
-		SupportedLanguage | 'pgsql' | 'javascript' | 'fetch' | 'docker' | 'powershell' | 'bunnative' | 'claudesandbox',
+		| SupportedLanguage
+		| 'pgsql'
+		| 'javascript'
+		| 'fetch'
+		| 'docker'
+		| 'powershell'
+		| 'bunnative'
+		| 'claudesandbox'
+		| 'pisandbox',
 		any
 	> = {
 		go: GoIcon,
@@ -114,7 +128,8 @@
 		rlang: RIcon,
 		duckdb: DuckDbIcon,
 		dbt: DbtIcon,
-		claudesandbox: TypeScriptIcon
+		claudesandbox: TypeScriptIcon,
+		pisandbox: TypeScriptIcon
 		// for related places search: ADD_NEW_LANG
 	}
 
@@ -166,4 +181,14 @@
 			/>
 		</div>
 	{/if}
+	{#if lang === 'pisandbox'}
+		<div
+			class="absolute -top-1.5 -right-1.5 bg-surface rounded-full flex items-center justify-center text-primary"
+			style={`width: ${width * scale * subIconScale}px; height: ${
+				height * scale * subIconScale
+			}px;`}
+		>
+			<Pi size={width * scale * (subIconScale - 0.1)} />
+		</div>
+	{/if}
 </div>
diff --git a/frontend/src/lib/components/common/table/AgentRow.svelte b/frontend/src/lib/components/common/table/AgentRow.svelte
index 8bb0bf3671..2d7d593b6e 100644
--- a/frontend/src/lib/components/common/table/AgentRow.svelte
+++ b/frontend/src/lib/components/common/table/AgentRow.svelte
@@ -16,6 +16,7 @@
 	import { agentMenuItems, deleteAgent } from '$lib/components/flows/agentActions'
 	import { getDeployUiSettings } from '$lib/components/home/deploy_ui'
 	import Row from './Row.svelte'
+	import { selectMenuItems, type RowSelection } from './rowSelection'
 
 	/**
 	 * A home-page row for a saved agent. The agent is an `ai_agent` resource, so the row opens the
@@ -30,6 +31,7 @@
 		depth?: number
 		menuOpen: boolean
 		keyboardSelected?: boolean
+		rowSelection?: RowSelection
 	}
 
 	let {
@@ -40,7 +42,8 @@
 		deleteConfirmedCallback = $bindable(),
 		depth = 0,
 		menuOpen = $bindable(),
-		keyboardSelected = false
+		keyboardSelected = false,
+		rowSelection = undefined
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
@@ -70,6 +73,7 @@
 	canFavorite={false}
 	editedAt={agent.edited_at}
 	{depth}
+	{rowSelection}
 >
 	{#snippet draftBadge()}
 		<DraftBadge
@@ -106,8 +110,9 @@
 		<Dropdown
 			size="sm"
 			fixedHeight={false}
-			items={async () =>
-				agentMenuItems({
+			items={async () => [
+				...selectMenuItems(rowSelection),
+				...agentMenuItems({
 					deployUiSettings: await getDeployUiSettings(),
 					path: agent.path,
 					canWrite: agent.canWrite,
@@ -120,7 +125,8 @@
 						if (event?.shiftKey) remove(path)
 						else deleteConfirmedCallback = () => remove(path)
 					}
-				})}
+				})
+			]}
 			on:open={() => {
 				menuOpen = true
 			}}
diff --git a/frontend/src/lib/components/common/table/PipelineRow.svelte b/frontend/src/lib/components/common/table/PipelineRow.svelte
new file mode 100644
index 0000000000..509297442b
--- /dev/null
+++ b/frontend/src/lib/components/common/table/PipelineRow.svelte
@@ -0,0 +1,155 @@
+<script lang="ts">
+	import { base } from '$lib/base'
+	import Dropdown from '$lib/components/DropdownV2.svelte'
+	import ConfirmationModal from '../confirmationModal/ConfirmationModal.svelte'
+	import {
+		deletePipeline,
+		planPipelineDelete,
+		type PipelineDeletePlan
+	} from '$lib/components/assets/AssetGraph/pipelineDelete'
+	import { userStore, workspaceStore } from '$lib/stores'
+	import { sendUserToast } from '$lib/toast'
+	import { Loader2, Trash } from 'lucide-svelte'
+	import Row from './Row.svelte'
+
+	interface Props {
+		folder: string
+		depth?: number
+		/** Shown instead of `f/<folder>`, e.g. under the folder's own tree node. */
+		label?: string
+		onDeleted?: () => void
+	}
+
+	let { folder, depth = 0, label, onDeleted }: Props = $props()
+
+	let confirmOpen = $state(false)
+	let deleting = $state(false)
+	let plan = $state<PipelineDeletePlan | undefined>(undefined)
+	let planError = $state<string | undefined>(undefined)
+	// The backend deletes scripts for admins only; everyone else archives them.
+	let hardDelete = $derived(!!($userStore?.is_admin || $userStore?.is_super_admin))
+
+	async function openConfirm() {
+		const ws = $workspaceStore
+		if (!ws) return
+		plan = undefined
+		planError = undefined
+		confirmOpen = true
+		try {
+			plan = await planPipelineDelete(ws, folder)
+		} catch (e: any) {
+			planError = e?.body ?? e?.message ?? String(e)
+		}
+	}
+
+	async function confirmDelete() {
+		const ws = $workspaceStore
+		if (!ws || !plan) return
+		deleting = true
+		try {
+			const { removed, failures } = await deletePipeline(ws, folder, plan, hardDelete)
+			// Loaded on demand: the home list should not pull in the session runtime.
+			const { forgetDeletedPipeline } = await import(
+				'$lib/components/sessions/sessionRuntime.svelte'
+			)
+			forgetDeletedPipeline(ws, folder)
+			if (failures.length) {
+				sendUserToast(`Pipeline f/${folder} was only partly removed`, true, [], failures.join('\n'))
+			} else {
+				sendUserToast(`Removed pipeline f/${folder} (${removed} item${removed === 1 ? '' : 's'})`)
+			}
+			onDeleted?.()
+		} catch (e: any) {
+			sendUserToast(`Could not remove pipeline f/${folder}: ${e?.body ?? e?.message ?? e}`, true)
+		} finally {
+			deleting = false
+			confirmOpen = false
+		}
+	}
+</script>
+
+<Row
+	kind="data_pipeline"
+	marked={undefined}
+	href="{base}/pipeline/{encodeURIComponent(folder)}"
+	workspaceId={$workspaceStore ?? ''}
+	path={`f/${folder}`}
+	summary={label ?? `Pipeline · ${folder}`}
+	canFavorite={false}
+	{depth}
+>
+	{#snippet actions()}
+		{#if !$userStore?.operator}
+			<Dropdown
+				items={[
+					{
+						displayName: 'Delete',
+						icon: Trash,
+						type: 'delete',
+						action: () => void openConfirm()
+					}
+				]}
+			/>
+		{/if}
+	{/snippet}
+</Row>
+
+<ConfirmationModal
+	open={confirmOpen}
+	title="Delete pipeline f/{folder}"
+	confirmationText={hardDelete ? 'Delete' : 'Archive'}
+	loading={deleting}
+	confirmDisabled={!plan}
+	trashbin={hardDelete}
+	on:canceled={() => (confirmOpen = false)}
+	on:confirmed={confirmDelete}
+>
+	<div class="flex flex-col gap-3 text-xs">
+		{#if planError}
+			<span class="text-red-600 dark:text-red-400">Could not list the pipeline: {planError}</span>
+		{:else if !plan}
+			<span class="flex items-center gap-2 text-secondary">
+				<Loader2 size={14} class="animate-spin" /> Listing what this removes…
+			</span>
+		{:else}
+			{#if plan.scripts.some((s) => !s.draftOnly)}
+				{@render group(
+					hardDelete ? 'Scripts deleted' : 'Scripts archived',
+					plan.scripts.filter((s) => !s.draftOnly).map((s) => s.displayPath)
+				)}
+			{/if}
+			{#if plan.scripts.some((s) => s.draftOnly)}
+				{@render group(
+					'Draft scripts discarded',
+					plan.scripts.filter((s) => s.draftOnly).map((s) => s.displayPath)
+				)}
+			{/if}
+			{#if plan.triggers.length}
+				{@render group(
+					'Triggers deleted',
+					plan.triggers.map((t) => `${t.path} (${t.kind})`)
+				)}
+			{/if}
+			{#if plan.hasDraft}
+				{@render group('Unsaved pipeline changes discarded', ['Your pipeline draft'])}
+			{/if}
+			{#if !plan.scripts.length && !plan.triggers.length && !plan.hasDraft}
+				<span class="text-secondary">Nothing left to remove in this pipeline.</span>
+			{/if}
+			<span class="text-secondary">
+				The tables and files the pipeline wrote are kept, and so is the folder f/{folder}.
+			</span>
+		{/if}
+	</div>
+</ConfirmationModal>
+
+{#snippet group(title: string, entries: string[])}
+	<div class="flex flex-col gap-1">
+		<span class="font-semibold text-emphasis">{title} ({entries.length})</span>
+		<ul class="max-h-40 overflow-auto rounded-md border bg-surface-secondary px-3 py-1.5">
+			{#each entries as entry (entry)}
+				<li class="font-mono text-2xs text-primary truncate">{entry}</li>
+			{/each}
+		</ul>
+	</div>
+{/snippet}
diff --git a/frontend/src/lib/components/common/tabs/DraggableTabs.svelte b/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
index f3870b3bb6..ae2c4c4bae 100644
--- a/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
+++ b/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
@@ -50,6 +50,9 @@
 		/** Render after the right-pinned tabs, outside the scroll area so it stays
 		 * pinned (e.g. a "Split with Preview" toggle). */
 		trailing?: import('svelte').Snippet
+		/** Tab height. `sm` (the default) is the 24px pill the panel strips use; `md` is 28px, for a
+		 * strip that fills a 44px bar, where the smaller pill leaves too much air around it. */
+		size?: 'sm' | 'md'
 		/** Render inside each tab (after the label; receives the tab + isActive). Clicks
 		 * bubble to the tab unless the accessory stops them. The tab is position:relative
 		 * so an `absolute inset-0 pointer-events-none` child can anchor a whole-tab
@@ -65,6 +68,7 @@
 		onReorder,
 		onActiveClick,
 		class: c = '',
+		size = 'sm',
 		afterTabs,
 		trailing,
 		tabAccessory
@@ -180,7 +184,8 @@
 
 	function tabClasses(isActive: boolean) {
 		return twMerge(
-			'group relative inline-flex items-center gap-1.5 px-2.5 h-6 text-xs rounded-md select-none cursor-pointer whitespace-nowrap transition-colors focus:outline-none focus-visible:ring-1 focus-visible:ring-border-selected focus-visible:ring-inset',
+			'group relative inline-flex items-center gap-1.5 text-xs rounded-md select-none cursor-pointer whitespace-nowrap transition-colors focus:outline-none focus-visible:ring-1 focus-visible:ring-border-selected focus-visible:ring-inset',
+			size === 'md' ? 'h-7 px-3 gap-2' : 'h-6 px-2.5',
 			isActive
 				? 'bg-surface-tertiary text-emphasis'
 				: 'bg-transparent text-hint hover:text-secondary'
diff --git a/frontend/src/lib/components/common/toggleButton-v2/ToggleButtonMore.svelte b/frontend/src/lib/components/common/toggleButton-v2/ToggleButtonMore.svelte
index 1300dc4322..86f04dfa9f 100644
--- a/frontend/src/lib/components/common/toggleButton-v2/ToggleButtonMore.svelte
+++ b/frontend/src/lib/components/common/toggleButton-v2/ToggleButtonMore.svelte
@@ -70,7 +70,14 @@
 		<div class="flex items-center">
 			<!-- The tooltip fixes a bug where the other tooltips won't disappear -->
 			<Tooltip disablePopup>
-				<DropdownV2 {btnText} enableFlyTransition {items} size={small ? 'sm' : 'md'} />
+				<!-- fixedHeight pins the wrapper at h-8, which overhangs a small group's 28px row. -->
+				<DropdownV2
+					{btnText}
+					enableFlyTransition
+					{items}
+					size={small ? 'sm' : 'md'}
+					fixedHeight={!small}
+				/>
 			</Tooltip>
 		</div>
 	</div>
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 8b0c346244..679f7c8bb2 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -501,11 +501,17 @@ export class AIChatManager implements ChatViewHost {
 	skipResponsesApi = $state(false)
 
 	mode = $state<AIMode>(AIMode.NAVIGATOR)
-	pipelineAiChatHelpers = $state<PipelineAIChatHelpers | undefined>(undefined)
+	// One per mounted pipeline editor; a session can have several folders open.
+	#pipelineEditors = new Set<PipelineAIChatHelpers>()
 	// Resolved when a pipeline editor registers its tools. open_preview(pipeline)
 	// awaits this so the model's next build_pipeline_node call can't race ahead of
 	// the async canvas mount and hit "Unknown tool call".
-	#pipelineHelpersWaiters = new Set<() => void>()
+	#pipelineHelpersWaiters = new Set<(helpers: PipelineAIChatHelpers) => void>()
+	// A session's pipeline editor unmounts whenever another tab takes the preview
+	// panel. Its tools stay offered for every folder the session opened, and a call
+	// reopens the tab through this, so a page shown in between costs no failed call.
+	#pipelineReopener: ((folder: string) => void) | undefined = undefined
+	#openedPipelineFolders = new Set<string>()
 	readonly isOpen = $derived(chatState.size > 0)
 	savedSize = $state<number>(0)
 	instructions = $state<string>('')
@@ -900,6 +906,15 @@ export class AIChatManager implements ChatViewHost {
 		await this.#persistModifiedItems()
 	}
 
+	// Record the items deploying a chat-modified item produced — a pipeline's
+	// scripts — so a fork review selects exactly them. Persisted at once, like a
+	// discard: the deploy can run outside any turn.
+	async recordDeployedItems(itemKind: UserDraftItemKind, storagePaths: string[]) {
+		if (!this.modifiedItems || storagePaths.length === 0) return
+		for (const p of storagePaths) this.modifiedItems.add(maskKey(itemKind, p))
+		await this.#persistModifiedItems()
+	}
+
 	// Move a mask entry to the path a draft actually deployed to. A draft-only
 	// flow/app parks at a synthetic `draft_{uuid}` storage path and deploys to
 	// its chosen path — without the move, the existence check at the synthetic
@@ -2492,8 +2507,27 @@ export class AIChatManager implements ChatViewHost {
 
 	// Public because it is purely local, unlike `changeMode(GLOBAL)`, which also
 	// fires the three network refreshes.
+	setPipelineReopener = (reopen: (folder: string) => void) => {
+		this.#pipelineReopener = reopen
+	}
+
+	#pipelineFolders = (): string[] => [
+		...new Set([
+			...[...this.#pipelineEditors].map((p) => p.getFolder()),
+			...(this.#pipelineReopener ? this.#openedPipelineFolders : [])
+		])
+	]
+
+	#ensurePipeline = async (folder: string): Promise<PipelineAIChatHelpers | undefined> => {
+		const find = () => [...this.#pipelineEditors].find((p) => p.getFolder() === folder)
+		const live = find()
+		if (live || !this.#pipelineReopener) return live
+		this.#pipelineReopener(folder)
+		return (await this.waitForPipelineHelpers(folder)) ? find() : undefined
+	}
+
 	configureGlobalMode = () => {
-		const pipeline = this.pipelineAiChatHelpers
+		const hasPipelines = this.#pipelineFolders().length > 0
 		const opts = this.globalAssemblyOpts()
 		const baseHelpers: GlobalToolHelpers = {
 			// A session targets its own fixed (possibly forked) workspace, so capture it for
@@ -2525,7 +2559,14 @@ export class AIChatManager implements ChatViewHost {
 			}
 		}
 		this.#assembledTools = assembleGlobalTools(opts)
-		this.helpers = pipeline ? { ...baseHelpers, pipeline } : baseHelpers
+		this.helpers = hasPipelines
+			? {
+					...baseHelpers,
+					pipelines: () => [...this.#pipelineEditors],
+					pipelineFolders: this.#pipelineFolders,
+					ensurePipeline: this.#ensurePipeline
+				}
+			: baseHelpers
 		this.systemMessage = assembleGlobalSystemMessage(getCustomPromptParts(AIMode.GLOBAL), opts)
 		this.syncArtifactsSession()
 	}
@@ -2538,7 +2579,7 @@ export class AIChatManager implements ChatViewHost {
 		mcpServers: this.mcpServers,
 		access: this.sessionAccess,
 		sessionContext: this.sessionContextResolver?.(),
-		pipelineContext: this.pipelineAiChatHelpers?.getPipelineContext()
+		pipelineFolders: this.#pipelineFolders()
 	})
 
 	// Fetch the workspace's AI skills and, if GLOBAL mode is still active, rebuild
@@ -4870,19 +4911,18 @@ export class AIChatManager implements ChatViewHost {
 	// AI edits apply directly as drafts, so there is nothing to auto-accept.
 	// Returns a cleanup that tears the registration back down.
 	setPipelineHelpers = (pipelineHelpers: PipelineAIChatHelpers) => {
-		this.pipelineAiChatHelpers = pipelineHelpers
+		this.#pipelineEditors.add(pipelineHelpers)
+		this.#openedPipelineFolders.add(pipelineHelpers.getFolder())
 		untrack(() => {
 			if (this.mode === AIMode.GLOBAL) {
 				this.configureGlobalMode()
 			}
 		})
 		// The pipeline tools are now registered — release anything awaiting them.
-		const waiters = [...this.#pipelineHelpersWaiters]
-		this.#pipelineHelpersWaiters.clear()
-		waiters.forEach((resolve) => resolve())
+		;[...this.#pipelineHelpersWaiters].forEach((notify) => notify(pipelineHelpers))
 
 		return () => {
-			this.pipelineAiChatHelpers = undefined
+			this.#pipelineEditors.delete(pipelineHelpers)
 			untrack(() => {
 				if (this.mode === AIMode.GLOBAL) {
 					this.configureGlobalMode()
@@ -4892,15 +4932,16 @@ export class AIChatManager implements ChatViewHost {
 	}
 
 	/**
-	 * Await the pipeline editor's tool registration. Resolves `true` immediately
-	 * when a pipeline editor is already mounted, or when the next one registers;
-	 * resolves `false` after `timeoutMs` if none registers (e.g. a backgrounded
-	 * session whose preview tab is not mounted, or a closed tab). Callers must
-	 * treat `false` as "tools NOT available" rather than silently reporting
-	 * success — the open_preview handler surfaces that to the model.
+	 * Await the tool registration of the pipeline editor for `folder` (any folder
+	 * when unset). Resolves `true` immediately when one is already mounted, or when
+	 * it registers; resolves `false` after `timeoutMs` if none registers (e.g. a
+	 * session whose runtime is not mounted, or a closed tab). Callers must treat
+	 * `false` as "tools NOT available" rather than silently reporting success —
+	 * the open_preview handler surfaces that to the model.
 	 */
-	waitForPipelineHelpers = (timeoutMs = 8000): Promise<boolean> => {
-		if (this.pipelineAiChatHelpers) return Promise.resolve(true)
+	waitForPipelineHelpers = (folder?: string, timeoutMs = 8000): Promise<boolean> => {
+		const matches = (p: PipelineAIChatHelpers) => folder === undefined || p.getFolder() === folder
+		if ([...this.#pipelineEditors].some(matches)) return Promise.resolve(true)
 		return new Promise<boolean>((resolve) => {
 			let settled = false
 			const finish = (registered: boolean) => {
@@ -4909,7 +4950,9 @@ export class AIChatManager implements ChatViewHost {
 				this.#pipelineHelpersWaiters.delete(onRegister)
 				resolve(registered)
 			}
-			const onRegister = () => finish(true)
+			const onRegister = (p: PipelineAIChatHelpers) => {
+				if (matches(p)) finish(true)
+			}
 			this.#pipelineHelpersWaiters.add(onRegister)
 			setTimeout(() => finish(false), timeoutMs)
 		})
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index dbb3ac51e3..ea3bd62feb 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -4329,11 +4329,15 @@ describe('DOM selector chips scoped by app path', () => {
 describe('AIChatManager.waitForPipelineHelpers', () => {
 	function fakePipelineHelpers(): PipelineAIChatHelpers {
 		return {
+			getFolder: () => 'f',
+			hasDrafts: () => false,
 			getPipelineContext: () => ({ folder: 'f', mode: 'edit', nodes: [], assets: [] }),
 			getNodeBody: async () => undefined,
 			proposeNode: async () => ({ path: '', detectedReads: [], detectedWrites: [] }),
 			editNode: async () => ({ detectedReads: [], detectedWrites: [] }),
 			removeProposedNode: async () => {},
+			unconfiguredTriggers: async () => [],
+			setNodeTrigger: async () => ({ path: '', replaced: false }),
 			testNode: async () => undefined
 		}
 	}
@@ -4341,13 +4345,13 @@ describe('AIChatManager.waitForPipelineHelpers', () => {
 	it('resolves true immediately when a pipeline editor is already registered', async () => {
 		const manager = new AIChatManager()
 		manager.setPipelineHelpers(fakePipelineHelpers())
-		await expect(manager.waitForPipelineHelpers(1000)).resolves.toBe(true)
+		await expect(manager.waitForPipelineHelpers(undefined, 1000)).resolves.toBe(true)
 	})
 
 	it('resolves true once a pipeline editor registers', async () => {
 		const manager = new AIChatManager()
 		let outcome: boolean | undefined
-		const wait = manager.waitForPipelineHelpers(1000).then((v) => (outcome = v))
+		const wait = manager.waitForPipelineHelpers(undefined, 1000).then((v) => (outcome = v))
 		await Promise.resolve()
 		expect(outcome).toBeUndefined()
 		manager.setPipelineHelpers(fakePipelineHelpers())
@@ -4355,12 +4359,24 @@ describe('AIChatManager.waitForPipelineHelpers', () => {
 		expect(outcome).toBe(true)
 	})
 
+	it('waits for the editor of the requested folder, not any editor', async () => {
+		const manager = new AIChatManager()
+		manager.setPipelineHelpers(fakePipelineHelpers())
+		let outcome: boolean | undefined
+		const wait = manager.waitForPipelineHelpers('sales', 1000).then((v) => (outcome = v))
+		await Promise.resolve()
+		expect(outcome).toBeUndefined()
+		manager.setPipelineHelpers({ ...fakePipelineHelpers(), getFolder: () => 'sales' })
+		await wait
+		expect(outcome).toBe(true)
+	})
+
 	// The false result is the signal the open_preview handler needs: a backgrounded
 	// session's editor never mounts, so it must report "tools unavailable" rather
 	// than silently claim success.
 	it('resolves false after the timeout when no editor ever registers', async () => {
 		const manager = new AIChatManager()
-		await expect(manager.waitForPipelineHelpers(10)).resolves.toBe(false)
+		await expect(manager.waitForPipelineHelpers(undefined, 10)).resolves.toBe(false)
 	})
 })
 
diff --git a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
index 1a1412b9f8..3e0351f249 100644
--- a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
+++ b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
@@ -3,14 +3,12 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import SessionsBetaBanner from '$lib/components/sessions/SessionsBetaBanner.svelte'
 	import { zIndexes } from '$lib/zIndexes'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { workspaceStore } from '$lib/stores'
 	import { chatState } from './sharedChatState.svelte'
 	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
 	import { copilotInfo } from '$lib/aiStore'
 	import { aiChatManager } from './AIChatManager.svelte'
 	import { onDestroy } from 'svelte'
-	import Button from '$lib/components/common/button/Button.svelte'
-	import { Menu } from 'lucide-svelte'
 	import CreatedResourceActionDrawers from './CreatedResourceActionDrawers.svelte'
 
 	interface Props {
@@ -20,7 +18,6 @@
 		transitionClass?: string
 		isMobile?: boolean
 		children: any
-		onMenuOpen?: () => void
 		disableAi?: boolean
 		// Whether this layout loads the workspace AI config. It gates far more than
 		// the docked pane (code completion, metadata generation, the "open in AI
@@ -40,15 +37,14 @@
 		transitionClass = 'transition-all ease-in-out duration-200',
 		isMobile = false,
 		children,
-		onMenuOpen,
 		disableAi,
 		loadAiConfig = true,
 		showSessionsBetaBanner = false
 	}: Props = $props()
 
 	// The desktop rail is fixed-positioned, so the content is offset by a matching
-	// left padding (in rem, matching the rail). Mobile/operator/borderless: no rail.
-	let contentPadLeft = $derived(noBorder || $userStore?.operator || isMobile ? 0 : sidebarWidth)
+	// left padding (in rem, matching the rail). Drawer (mobile or detached)/borderless: no rail.
+	let contentPadLeft = $derived(noBorder || isMobile ? 0 : sidebarWidth)
 
 	$effect(() => {
 		chatState.dockedChatAvailable = !disableAi
@@ -83,23 +79,6 @@
 	})
 </script>
 
-{#snippet burgerRow()}
-	<div
-		class={classNames(
-			'py-0.5 px-4 sm:px-4 shadow-sm max-w-7xl md:hidden justify-start flex',
-			noBorder || $userStore?.operator ? 'hidden' : ''
-		)}
-	>
-		<Button
-			variant="subtle"
-			unifiedSize="lg"
-			onClick={() => onMenuOpen?.()}
-			startIcon={{ icon: Menu }}
-			iconOnly
-		/>
-	</div>
-{/snippet}
-
 {#if !disableAi}
 	<CreatedResourceActionDrawers />
 	<Splitpanes horizontal={false} class="flex-1 min-h-0">
@@ -111,7 +90,6 @@
 			>
 				<main class="flex-1 flex flex-col min-h-0">
 					<div class="relative w-full flex-1 flex flex-col min-h-0">
-						{@render burgerRow()}
 						<div class="flex-1 min-h-0">
 							{@render children?.()}
 						</div>
@@ -138,12 +116,14 @@
 		{/if}
 	</Splitpanes>
 {:else}
+	<!-- The scroll lives here, below the page header, exactly as it does in the docked-chat layout
+	     above: a page taller than the window scrolls inside this box, so the band stays on screen
+	     instead of leaving with the content. -->
 	<div
 		id="content"
-		class={classNames('flex-1 min-h-0 flex flex-col', transitionClass)}
+		class={classNames('flex-1 min-h-0 flex flex-col overflow-y-auto', transitionClass)}
 		style:padding-left="{contentPadLeft}rem"
 	>
-		{@render burgerRow()}
 		<div class="flex-1 min-h-0 flex flex-col">
 			{@render children?.()}
 		</div>
diff --git a/frontend/src/lib/components/copilot/chat/anthropic.ts b/frontend/src/lib/components/copilot/chat/anthropic.ts
index ab69d0b1a3..ce11b0dade 100644
--- a/frontend/src/lib/components/copilot/chat/anthropic.ts
+++ b/frontend/src/lib/components/copilot/chat/anthropic.ts
@@ -19,6 +19,7 @@ import { applyReasoningToConfig } from '../reasoningRegistry'
 import {
 	appendPendingToolImages,
 	processToolCall,
+	type LiveToolSet,
 	queuedToolStatus,
 	type Tool,
 	type ToolCallbacks,
@@ -197,7 +198,11 @@ export async function parseAnthropicCompletion(
 	tools: Tool<any>[],
 	helpers: any,
 	abortController?: AbortController,
-	options?: { workspace?: string; onTokenUsage?: (usage: ChatTokenUsage) => void }
+	options?: {
+		workspace?: string
+		onTokenUsage?: (usage: ChatTokenUsage) => void
+		live?: LiveToolSet
+	}
 ): Promise<ParsedCompletionResult> {
 	let toolCallsToProcess: ChatCompletionMessageFunctionToolCall[] = []
 	let error = null
@@ -447,7 +452,8 @@ export async function parseAnthropicCompletion(
 				helpers,
 				toolCallbacks: callbacks,
 				workspace: options?.workspace,
-				messages
+				messages,
+				live: options?.live
 			})
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
diff --git a/frontend/src/lib/components/copilot/chat/chatLoop.ts b/frontend/src/lib/components/copilot/chat/chatLoop.ts
index cde9d554cd..1e27becba0 100644
--- a/frontend/src/lib/components/copilot/chat/chatLoop.ts
+++ b/frontend/src/lib/components/copilot/chat/chatLoop.ts
@@ -453,7 +453,8 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 		const parseOptions = {
 			workspace,
 			provider: modelProvider.provider,
-			onTokenUsage: reportUsage
+			onTokenUsage: reportUsage,
+			live: () => ({ tools: config.tools, helpers: config.helpers })
 		}
 
 		if (isOpenAI) {
diff --git a/frontend/src/lib/components/copilot/chat/flow/openFlow.json b/frontend/src/lib/components/copilot/chat/flow/openFlow.json
index 2224d89b78..11cee5b724 100644
--- a/frontend/src/lib/components/copilot/chat/flow/openFlow.json
+++ b/frontend/src/lib/components/copilot/chat/flow/openFlow.json
@@ -1 +1 @@
-{"openapi":"3.0.3","info":{"version":"1.825.0","title":"OpenFlow Spec","contact":{"name":"Ruben Fiszel","email":"ruben@windmill.dev","url":"https://windmill.dev"},"license":{"name":"Apache 2.0","url":"https://www.apache.org/licenses/LICENSE-2.0.html"}},"paths":{},"externalDocs":{"description":"documentation portal","url":"https://windmill.dev"},"components":{"schemas":{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution — modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind"}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type"}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw",null]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw",null]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}]},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}}}
\ No newline at end of file
+{"openapi":"3.0.3","info":{"version":"1.825.0","title":"OpenFlow Spec","contact":{"name":"Ruben Fiszel","email":"ruben@windmill.dev","url":"https://windmill.dev"},"license":{"name":"Apache 2.0","url":"https://www.apache.org/licenses/LICENSE-2.0.html"}},"paths":{},"externalDocs":{"description":"documentation portal","url":"https://windmill.dev"},"components":{"schemas":{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff: the n-th retry waits multiplier × seconds^n","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution — modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind"}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type"}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw",null]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw",null]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}]},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}}}
\ No newline at end of file
diff --git a/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts b/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts
index 570c83f52d..88cb8fe875 100644
--- a/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts
@@ -1,6 +1,6 @@
 import { z } from "zod"
 
-export const flowModuleValueSchema = z.discriminatedUnion("type", [z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "content": z.string().describe("The script source code. Should export a 'main' function"), "language": z.enum(["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]).describe("Programming language for this script"), "path": z.string().describe("Optional path for saving this script").optional(), "lock": z.string().describe("Lock file content for dependencies").optional(), "type": z.literal("rawscript"), "tag": z.string().describe("Worker group tag for execution routing").optional(), "concurrent_limit": z.number().describe("Maximum concurrent executions of this script").optional(), "concurrency_time_window_s": z.number().describe("Time window for concurrent_limit").optional(), "custom_concurrency_key": z.string().describe("Custom key for grouping concurrent executions").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional(), "assets": z.array(z.object({ "path": z.string().describe("Path to the asset"), "kind": z.enum(["s3object","resource","ducklake","datatable","volume","dbt"]).describe("Type of asset"), "access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Access level for this asset").optional(), "alt_access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Alternative access level").optional() })).describe("External resources this script accesses (S3 objects, resources, etc.)").optional() }).describe("Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "path": z.string().describe("Path to the script in the workspace (e.g., 'f/scripts/send_email')"), "hash": z.string().describe("Optional specific version hash of the script to use").optional(), "type": z.literal("script"), "tag_override": z.string().describe("Override the script's default worker group tag").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional() }).describe("Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments"), "path": z.string().describe("Path to the flow in the workspace (e.g., 'f/flows/process_user')"), "type": z.literal("flow") }).describe("Reference to an existing flow by path. Use this to call another flow as a subflow"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'"), "iterator": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("forloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in each iteration"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("whileloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (use with caution in while loops)").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch condition").optional(), "expr": z.string().describe("JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if this branch's expr is true") })).describe("Array of branches to evaluate in order. The first branch with expr evaluating to true executes"), "default": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if no branch expressions match"), "type": z.literal("branchone") }).describe("Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch's purpose").optional(), "skip_failure": z.boolean().describe("If true, failure in this branch doesn't fail the entire flow").optional(), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in this branch") })).describe("Array of branches that all execute (either in parallel or sequentially)"), "type": z.literal("branchall"), "parallel": z.boolean().describe("If true, all branches execute concurrently. If false, they execute sequentially").optional() }).describe("Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently"), z.object({ "type": z.literal("identity"), "flow": z.boolean().describe("If true, marks this as a flow identity (special handling)").optional() }).describe("Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined").optional(), "output_type": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n").optional(), "user_message": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n").optional(), "system_prompt": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("System instructions that guide the AI's behavior, persona, and response style. Optional.").optional(), "streaming": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n").optional(), "memory": z.discriminatedUnion("type", [z.object({ "value": z.discriminatedUnion("kind", [z.object({ "kind": z.literal("off") }).describe("No conversation memory/context"), z.object({ "kind": z.literal("window"), "context_length": z.number().int().describe("Number of most recent messages to load and store. 0 turns memory off.") }).describe("Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n"), z.object({ "kind": z.literal("compaction"), "context_window": z.number().int().describe("Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n").optional() }).describe("Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n"), z.object({ "kind": z.literal("auto"), "context_length": z.number().int().describe("Maximum number of messages to retain in context").optional(), "memory_id": z.string().describe("Identifier for persistent memory across agent invocations").optional() }).describe("Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n"), z.object({ "kind": z.literal("manual"), "messages": z.array(z.object({ "role": z.enum(["user","assistant","system"]), "content": z.string() }).describe("A single message in conversation history")) }).describe("Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.")]).describe("Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`."), "type": z.literal("static") }).describe("Static memory configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined").optional(), "memory_id": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n").optional(), "previous_messages": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n").optional(), "output_schema": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n").optional(), "user_attachments": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n").optional(), "enabled_tools": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n").optional(), "max_completion_tokens": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n").optional(), "temperature": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n").optional(), "max_iterations": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n").optional() }).describe("Input parameters for the AI agent mapped to their values"), "tools": z.array(z.object({ "id": z.string().describe("Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"), "summary": z.string().describe("The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'.").optional(), "description": z.string().describe("Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it.").optional(), "value": z.any().superRefine((x, ctx) => {
+export const flowModuleValueSchema = z.discriminatedUnion("type", [z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "content": z.string().describe("The script source code. Should export a 'main' function"), "language": z.enum(["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]).describe("Programming language for this script"), "path": z.string().describe("Optional path for saving this script").optional(), "lock": z.string().describe("Lock file content for dependencies").optional(), "type": z.literal("rawscript"), "tag": z.string().describe("Worker group tag for execution routing").optional(), "concurrent_limit": z.number().describe("Maximum concurrent executions of this script").optional(), "concurrency_time_window_s": z.number().describe("Time window for concurrent_limit").optional(), "custom_concurrency_key": z.string().describe("Custom key for grouping concurrent executions").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional(), "assets": z.array(z.object({ "path": z.string().describe("Path to the asset"), "kind": z.enum(["s3object","resource","ducklake","datatable","volume","dbt"]).describe("Type of asset"), "access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Access level for this asset").optional(), "alt_access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Alternative access level").optional() })).describe("External resources this script accesses (S3 objects, resources, etc.)").optional() }).describe("Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "path": z.string().describe("Path to the script in the workspace (e.g., 'f/scripts/send_email')"), "hash": z.string().describe("Optional specific version hash of the script to use").optional(), "type": z.literal("script"), "tag_override": z.string().describe("Override the script's default worker group tag").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional() }).describe("Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments"), "path": z.string().describe("Path to the flow in the workspace (e.g., 'f/flows/process_user')"), "type": z.literal("flow") }).describe("Reference to an existing flow by path. Use this to call another flow as a subflow"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'"), "iterator": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("forloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in each iteration"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("whileloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (use with caution in while loops)").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch condition").optional(), "expr": z.string().describe("JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if this branch's expr is true") })).describe("Array of branches to evaluate in order. The first branch with expr evaluating to true executes"), "default": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if no branch expressions match"), "type": z.literal("branchone") }).describe("Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch's purpose").optional(), "skip_failure": z.boolean().describe("If true, failure in this branch doesn't fail the entire flow").optional(), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in this branch") })).describe("Array of branches that all execute (either in parallel or sequentially)"), "type": z.literal("branchall"), "parallel": z.boolean().describe("If true, all branches execute concurrently. If false, they execute sequentially").optional() }).describe("Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently"), z.object({ "type": z.literal("identity"), "flow": z.boolean().describe("If true, marks this as a flow identity (special handling)").optional() }).describe("Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined").optional(), "output_type": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n").optional(), "user_message": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n").optional(), "system_prompt": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("System instructions that guide the AI's behavior, persona, and response style. Optional.").optional(), "streaming": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n").optional(), "memory": z.discriminatedUnion("type", [z.object({ "value": z.discriminatedUnion("kind", [z.object({ "kind": z.literal("off") }).describe("No conversation memory/context"), z.object({ "kind": z.literal("window"), "context_length": z.number().int().describe("Number of most recent messages to load and store. 0 turns memory off.") }).describe("Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n"), z.object({ "kind": z.literal("compaction"), "context_window": z.number().int().describe("Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n").optional() }).describe("Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n"), z.object({ "kind": z.literal("auto"), "context_length": z.number().int().describe("Maximum number of messages to retain in context").optional(), "memory_id": z.string().describe("Identifier for persistent memory across agent invocations").optional() }).describe("Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n"), z.object({ "kind": z.literal("manual"), "messages": z.array(z.object({ "role": z.enum(["user","assistant","system"]), "content": z.string() }).describe("A single message in conversation history")) }).describe("Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.")]).describe("Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`."), "type": z.literal("static") }).describe("Static memory configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined").optional(), "memory_id": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n").optional(), "previous_messages": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n").optional(), "output_schema": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n").optional(), "user_attachments": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n").optional(), "enabled_tools": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n").optional(), "max_completion_tokens": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n").optional(), "temperature": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n").optional(), "max_iterations": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n").optional() }).describe("Input parameters for the AI agent mapped to their values"), "tools": z.array(z.object({ "id": z.string().describe("Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"), "summary": z.string().describe("The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'.").optional(), "description": z.string().describe("Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it.").optional(), "value": z.any().superRefine((x, ctx) => {
     const schemas = [z.intersection(z.object({ "tool_type": z.literal("flowmodule") }), z.lazy(() => flowModuleValueSchema)).describe("A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module"), z.object({ "tool_type": z.literal("mcp"), "resource_path": z.string().describe("Path to the MCP resource/server configuration"), "include_tools": z.array(z.string()).describe("Whitelist of specific tools to include from this MCP server").optional(), "exclude_tools": z.array(z.string()).describe("Blacklist of tools to exclude from this MCP server").optional() }).describe("Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers"), z.object({ "tool_type": z.literal("websearch") }).describe("A tool implemented as a websearch tool. The AI can call this like any other websearch tool")];
     const errors = schemas.reduce<z.ZodError[]>(
       (errors, schema) =>
@@ -37,7 +37,7 @@ export const flowModuleSchema = z.object({ "id": z.string().describe("Unique ide
         message: "Invalid input: Should pass single schema",
       });
     }
-  }).describe("The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference") }).describe("A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool")).describe("Array of tools the agent can use. The agent decides which tools to call based on the task").optional(), "type": z.literal("aiagent"), "tag": z.string().describe("Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)").optional(), "omit_output_from_conversation": z.boolean().describe("If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled.").default(false), "agent": z.string().describe("Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n").optional(), "tool_inputs": z.record(z.string(), z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"))).describe("Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n").optional(), "parallel": z.boolean().describe("If true, the agent can execute multiple tool calls in parallel").optional() }).describe("AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined"), "state": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"), "questions": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n") }).describe("Input parameters for the decision mapped to their values"), "type": z.literal("aidecision"), "tag": z.string().describe("Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)").optional() }).describe("AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n")]).describe("The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type"), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")
+  }).describe("The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference") }).describe("A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool")).describe("Array of tools the agent can use. The agent decides which tools to call based on the task").optional(), "type": z.literal("aiagent"), "tag": z.string().describe("Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)").optional(), "omit_output_from_conversation": z.boolean().describe("If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled.").default(false), "agent": z.string().describe("Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n").optional(), "tool_inputs": z.record(z.string(), z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"))).describe("Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n").optional(), "parallel": z.boolean().describe("If true, the agent can execute multiple tool calls in parallel").optional() }).describe("AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined"), "state": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"), "questions": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n") }).describe("Input parameters for the decision mapped to their values"), "type": z.literal("aidecision"), "tag": z.string().describe("Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)").optional() }).describe("AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n")]).describe("The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type"), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")
 
 
 export const flowModulesSchema = z.array(flowModuleSchema)
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 23a80c4026..b04493355e 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -1,6 +1,7 @@
 import { randomUUID } from '$lib/utils/uuid'
 import {
 	AppService,
+	AssetService,
 	AzureTriggerService,
 	EmailTriggerService,
 	FlowService,
@@ -67,6 +68,7 @@ import {
 	stripFileArgs
 } from '$lib/components/job_args'
 import { processSecretArgs } from '$lib/components/secretArgUtils'
+import { parsePipelineAnnotations } from '$lib/components/assets/AssetGraph/parsePipelineAnnotations'
 import { PLAN_MODE_MESSAGES } from '../planModeMessages'
 import {
 	DEFAULT_DATA as DEFAULT_RAW_APP_DATA,
@@ -423,6 +425,8 @@ const updateUserInstructionsSchema = z.object({
 		)
 })
 
+const listPipelinesSchema = z.object({})
+
 const listWorkspaceItemsSchema = z.object({
 	types: z
 		.array(itemTypeSchema)
@@ -1424,7 +1428,7 @@ const buildGlobalSystemPrompt = (
 	const activePreviewRule = previewTools
 		? '\n- If the user message includes an ACTIVE PREVIEW section, that is the page the side panel is showing — resolve "this page", "here" and "it" against it, and against `open` (the item the user has open in its editor) when there is one. It already tells you what get_preview_status would, so do not call that tool to learn what is on screen; call it only to check the panel\'s *other* tabs.'
 		: ''
-	const pipelineBullet = `- A "data pipeline" is NOT a flow: it is a DAG of independent scripts in one folder, wired by storage assets (DuckLake/data tables/S3) and triggers via top-of-file \`pipeline\` / \`on <ref>\` annotation comments written in each script's comment syntax (\`--\` for SQL, \`#\` for Python/Bash, \`//\` for TS — a \`//\` line in a SQL node is a syntax error). When the user asks for a data pipeline (or to ingest/transform/materialize data across steps), call get_instructions with subject "pipeline" and build annotated script drafts — do not build a flow.${pipelineAlphaNote}`
+	const pipelineBullet = `- A "data pipeline" is NOT a flow: it is a DAG of independent scripts in one folder, wired by storage assets (DuckLake/data tables/S3) and triggers via top-of-file \`pipeline\` / \`on <ref>\` annotation comments written in each script's comment syntax (\`--\` for SQL, \`#\` for Python/Bash, \`//\` for TS — a \`//\` line in a SQL node is a syntax error). When the user asks for a data pipeline (or to ingest/transform/materialize data across steps), call get_instructions with subject "pipeline" and build annotated script drafts — do not build a flow. list_pipelines lists the existing ones by folder.${pipelineAlphaNote}`
 	// Hosting and edition come from the hostname and a store the app populates at init, so
 	// they are knowable only in the browser: a non-browser caller reads false for both and
 	// would be told "self-hosted Community Edition" whatever it targets. No base URL here
@@ -1524,7 +1528,7 @@ ${pipelineBullet}`
 					canWriteDraft,
 					`
 - After writing or substantially editing a script / flow / app draft, show it via open_preview(kind, path) so the user sees the editor and live preview right next to the chat. First check whether it is already shown: if unsure, call get_preview_status. Only call open_preview (or offer to) when no preview is open or it is showing a different item — don't re-open a preview already showing the item you just edited.
-- Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty ${when(canCreateFolder, 'or not-yet-created ')}folder is fine${when(canCreateFolder, ' (create_folder first if needed, then open it)')}. Opening it registers build_pipeline_node / edit_pipeline_node — use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.`
+- Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty ${when(canCreateFolder, 'or not-yet-created ')}folder is fine${when(canCreateFolder, ' (create_folder first if needed, then open it)')}. Opening it adds build_pipeline_node / edit_pipeline_node to your tools from the next step on — they are not in your tool list before open_preview returns, so call open_preview on its own, wait for its result, then build. They then stay available for the rest of the session even while another tab (a page, another preview) is shown: a call brings the pipeline editor back by itself, so do not re-open it first. Use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.`
 				)}
 - When debugging a running raw app, call get_app_runtime_logs to read the live preview's browser console output. It needs the raw app preview open (open_preview kind="raw_app").
 - Writing an app file does not compile it: the open preview rebuilds it afterwards. After editing a raw app's frontend files with its preview open, call get_app_runtime_logs to check the build — when it failed, it returns the build errors (e.g. syntax or import errors) and bundler logs to fix.
@@ -2719,7 +2723,7 @@ function allowedTriggerKinds(): PageTriggerKind[] {
 }
 
 // Pages an operator may reach: exactly the ones enabled in the workspace's
-// operator_settings, the same source OperatorMenu gates on. Operators are never admins, so
+// operator_settings, the same source the sidebar gates on. Operators are never admins, so
 // workspace_settings is excluded whatever the settings say.
 function operatorOpenPages(workspaceId: string | undefined): OpenPageName[] {
 	const settings = get(userWorkspaces).find((w) => w.id === workspaceId)?.operator_settings
@@ -3654,6 +3658,23 @@ export const globalTools: SessionTool<{}>[] = [
 			return JSON.stringify(results, null, 2)
 		}
 	},
+	{
+		requires: NONE,
+		def: createToolDef(
+			listPipelinesSchema,
+			'list_pipelines',
+			'List the data pipelines of the workspace: each folder holding at least one pipeline script, with its number of scripts. A pipeline is named by its folder, not by an item path.'
+		),
+		planModeSafe: true,
+		fn: async ({ workspace, toolId, toolCallbacks }) => {
+			toolCallbacks.setToolStatus(toolId, { content: 'Listing data pipelines...' })
+			const pipelines = await AssetService.listPipelineFolders({ workspace })
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Listed ${pipelines.length} data pipeline(s)`
+			})
+			return JSON.stringify(pipelines)
+		}
+	},
 	{
 		requires: NONE,
 		def: createToolDef(
@@ -4291,7 +4312,7 @@ export const globalTools: SessionTool<{}>[] = [
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Found ${results.length} resource type(s) for "${parsed.query}"`
 			})
-			return JSON.stringify(
+			const listing = JSON.stringify(
 				results.map((rt) => ({
 					name: rt.name,
 					schema: rt.schema
@@ -4299,6 +4320,15 @@ export const globalTools: SessionTool<{}>[] = [
 				null,
 				2
 			)
+			// The search is semantic and always returns its closest types, so a miss reads
+			// like a hit unless the absence is spelled out.
+			const words = (parsed.query.toLowerCase().match(/[a-z0-9]+/g) ?? []).filter(
+				(w) => w.length >= 3
+			)
+			const named = results.some((rt) => words.some((w) => rt.name.toLowerCase().includes(w)))
+			return named || words.length === 0
+				? listing
+				: `${listing}\n\nNo resource type name contains "${parsed.query}": these are only the nearest matches, so no dedicated type exists. Searching again with synonyms will not find one — use a fitting generic type above, or create a custom c_<name> type.`
 		}
 	},
 	createDbSchemaTool<{}>({
@@ -5471,6 +5501,17 @@ function writeScriptDraft(
 	ctx: WriteDraftCtx,
 	codeDiff?: ToolCodeDiff
 ): Promise<string> {
+	// A session builds pipeline nodes into the folder's pipeline draft; a script draft
+	// written here never reaches the pipeline graph, and saving the pipeline drops it.
+	if (
+		(ctx.sessionId ?? sessionIdFromCtx(ctx)) &&
+		parsePipelineAnnotations(args.content).inPipeline
+	) {
+		const folder = args.path.match(/^f\/([^/]+)\//)?.[1] ?? '<folder>'
+		throw new Error(
+			`"${args.path}" is a data pipeline node (its source starts with the pipeline annotation). In a session, pipeline nodes are not script drafts: call open_preview(kind="pipeline", path="${folder}") if that folder's pipeline editor is not open yet, then use build_pipeline_node (new node) or edit_pipeline_node (existing node). Nothing was written.`
+		)
+	}
 	return writeDraft(SCRIPT_SPEC, 'script', args.path, args, ctx, {
 		override: args.override,
 		codeDiff:
diff --git a/frontend/src/lib/components/copilot/chat/global/globalAssembly.test.ts b/frontend/src/lib/components/copilot/chat/global/globalAssembly.test.ts
index feffda425e..dcb46ca148 100644
--- a/frontend/src/lib/components/copilot/chat/global/globalAssembly.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/globalAssembly.test.ts
@@ -15,22 +15,17 @@ vi.mock('@codingame/monaco-vscode-languages-service-override', () => ({ default:
 vi.mock('$lib/components/vscode', () => ({}))
 
 import { getSessionContextPromptSection, type SessionPromptContext } from './core'
-import { getPipelinePromptSection, type PipelineContext } from '../pipeline/core'
+import { getPipelinePromptSection } from '../pipeline/core'
 import { assembleGlobalSystemMessage, assembleGlobalTools } from './globalAssembly'
 
 const sessionContext: SessionPromptContext = { workspaceId: 'ws', parentWorkspaceId: 'parent' }
-const pipelineContext: PipelineContext = {
-	folder: 'myfolder',
-	mode: 'edit',
-	nodes: [],
-	assets: []
-}
+const pipelineFolders = ['myfolder']
 
 describe('assembleGlobalTools', () => {
 	it('includes the pipeline tools only when a pipeline editor is active', () => {
 		const names = (opts: Parameters<typeof assembleGlobalTools>[0]) =>
 			assembleGlobalTools(opts).map((t) => t.def.function.name)
-		expect(names({ pipelineContext })).toContain('get_pipeline_graph')
+		expect(names({ pipelineFolders })).toContain('get_pipeline_graph')
 		expect(names({})).not.toContain('get_pipeline_graph')
 	})
 })
@@ -41,13 +36,13 @@ describe('assembleGlobalSystemMessage', () => {
 	it('carries both optional sections when both contexts are given', () => {
 		const content = assembleGlobalSystemMessage(undefined, {
 			sessionContext,
-			pipelineContext
+			pipelineFolders
 		}).content as string
 		expect(content).toContain(getSessionContextPromptSection(sessionContext))
-		expect(content).toContain(getPipelinePromptSection(pipelineContext))
+		expect(content).toContain(getPipelinePromptSection(pipelineFolders))
 		// Order is part of the assembled output, so it is pinned too.
 		expect(content.indexOf(getSessionContextPromptSection(sessionContext))).toBeLessThan(
-			content.indexOf(getPipelinePromptSection(pipelineContext))
+			content.indexOf(getPipelinePromptSection(pipelineFolders))
 		)
 	})
 
@@ -58,6 +53,6 @@ describe('assembleGlobalSystemMessage', () => {
 		// shares, so a stray section built from any other context still trips them.
 		const heading = (s: string) => s.trim().split('\n')[0]
 		expect(content).not.toContain(heading(getSessionContextPromptSection(sessionContext)))
-		expect(content).not.toContain(heading(getPipelinePromptSection(pipelineContext)))
+		expect(content).not.toContain(heading(getPipelinePromptSection(pipelineFolders)))
 	})
 })
diff --git a/frontend/src/lib/components/copilot/chat/global/globalAssembly.ts b/frontend/src/lib/components/copilot/chat/global/globalAssembly.ts
index a291e93ec7..d1fe80f13d 100644
--- a/frontend/src/lib/components/copilot/chat/global/globalAssembly.ts
+++ b/frontend/src/lib/components/copilot/chat/global/globalAssembly.ts
@@ -12,7 +12,7 @@ import {
 	type SessionPromptContext
 } from './core'
 import { createMcpTools } from './mcpTools'
-import { getPipelinePromptSection, pipelineTools, type PipelineContext } from '../pipeline/core'
+import { getPipelinePromptSection, pipelineTools } from '../pipeline/core'
 import { getFolderInstructionsPromptSection, type FolderInstruction } from '../folderInstructions'
 
 // Derived, not retyped: an option added to prepareGlobalSystemMessage is reachable
@@ -21,7 +21,8 @@ import { getFolderInstructionsPromptSection, type FolderInstruction } from '../f
 // directly — would get it.
 export type GlobalAssemblyOpts = NonNullable<Parameters<typeof prepareGlobalSystemMessage>[1]> & {
 	sessionContext?: SessionPromptContext
-	pipelineContext?: PipelineContext
+	/** Folders of the open pipeline editors; the pipeline tools and prompt come with any. */
+	pipelineFolders?: readonly string[]
 	folderInstructions?: readonly FolderInstruction[]
 }
 
@@ -34,8 +35,8 @@ export function assembleGlobalSystemMessage(
 	if (opts.sessionContext) {
 		systemMessage.content += getSessionContextPromptSection(opts.sessionContext, opts.access)
 	}
-	if (opts.pipelineContext) {
-		systemMessage.content += getPipelinePromptSection(opts.pipelineContext, opts.access)
+	if (opts.pipelineFolders?.length) {
+		systemMessage.content += getPipelinePromptSection(opts.pipelineFolders, opts.access)
 	}
 	return systemMessage
 }
@@ -43,7 +44,7 @@ export function assembleGlobalSystemMessage(
 export function assembleGlobalTools(opts: GlobalAssemblyOpts): SessionTool<any>[] {
 	return [
 		...globalToolsFor({ sessionPreview: opts.previewTools ?? false }),
-		...(opts.pipelineContext ? pipelineTools : []),
+		...(opts.pipelineFolders?.length ? pipelineTools : []),
 		...createMcpTools(opts.mcpServers ?? [])
 	]
 }
diff --git a/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts b/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts
index 42136112c4..143def2fc8 100644
--- a/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts
@@ -32,7 +32,7 @@ import type { SessionAccess, SessionCapability, SessionTool } from '../sessionCa
 
 const ASSEMBLY_OPTS = {
 	previewTools: true,
-	pipelineContext: { folder: 'my_pipeline', mode: 'edit', nodes: [], assets: [] },
+	pipelineFolders: ['my_pipeline'],
 	mcpServers: [{ path: 'f/test/server' } as any]
 }
 
@@ -168,7 +168,7 @@ describe('session tool policies', () => {
 						user: { username: 'alex', folders: ['shared'], folders_read: ['shared'] },
 						access,
 						sessionContext: ctx,
-						pipelineContext: { folder: 'my_pipeline', mode: 'edit', nodes: [], assets: [] }
+						pipelineFolders: ['my_pipeline']
 					})
 					// Both decoration variants: the escalation one adds its own tool mentions.
 					for (const blocks of [0, 9]) {
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.ts b/frontend/src/lib/components/copilot/chat/openai-responses.ts
index 3a839f4bad..13143f6bce 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.ts
@@ -18,6 +18,7 @@ import { applyReasoningToConfig } from '../reasoningRegistry'
 import {
 	appendPendingToolImages,
 	processToolCall,
+	type LiveToolSet,
 	queuedToolStatus,
 	type Tool,
 	type ToolCallbacks,
@@ -413,7 +414,11 @@ export async function parseOpenAIResponsesCompletion(
 	addedMessages: ChatCompletionMessageParam[],
 	tools: Tool<any>[],
 	helpers: any,
-	options?: { workspace?: string; onTokenUsage?: (usage: ChatTokenUsage) => void }
+	options?: {
+		workspace?: string
+		onTokenUsage?: (usage: ChatTokenUsage) => void
+		live?: LiveToolSet
+	}
 ): Promise<ParsedCompletionResult> {
 	let toolCallsToProcess: ChatCompletionMessageFunctionToolCall[] = []
 	let error: OpenAIError | ResponseErrorEvent | null = null
@@ -620,7 +625,8 @@ export async function parseOpenAIResponsesCompletion(
 				helpers,
 				toolCallbacks: callbacks,
 				workspace: options?.workspace,
-				messages
+				messages,
+				live: options?.live
 			})
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
diff --git a/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts b/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts
index c0d9b7ac8b..6c4539ef85 100644
--- a/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts
@@ -39,7 +39,7 @@ const sampleContext: PipelineContext = {
 }
 
 function makeHelpers(overrides: Partial<PipelineAIChatHelpers> = {}): {
-	helpers: { pipeline: PipelineAIChatHelpers }
+	helpers: { pipelines: () => PipelineAIChatHelpers[] }
 	calls: Record<string, any[]>
 } {
 	const calls: Record<string, any[]> = {}
@@ -50,6 +50,8 @@ function makeHelpers(overrides: Partial<PipelineAIChatHelpers> = {}): {
 			return ret
 		}
 	const pipeline: PipelineAIChatHelpers = {
+		getFolder: () => sampleContext.folder,
+		hasDrafts: () => false,
 		getPipelineContext: () => sampleContext,
 		getNodeBody: async (path: string) => {
 			calls.getNodeBody = [...(calls.getNodeBody ?? []), [path]]
@@ -59,15 +61,20 @@ function makeHelpers(overrides: Partial<PipelineAIChatHelpers> = {}): {
 			calls.proposeNode = [...(calls.proposeNode ?? []), [input]]
 			return { path: input.path, detectedReads: [], detectedWrites: [] }
 		},
-		editNode: async (path, content) => {
-			calls.editNode = [...(calls.editNode ?? []), [path, content]]
-			return { detectedReads: [], detectedWrites: [] }
+		editNode: async (path, content, summary) => {
+			calls.editNode = [...(calls.editNode ?? []), [path, content, summary]]
+			return { summary: summary ?? 'Existing summary', detectedReads: [], detectedWrites: [] }
 		},
 		removeProposedNode: record('removeProposedNode'),
+		unconfiguredTriggers: async () => [],
+		setNodeTrigger: async (path, kind, config) => {
+			calls.setNodeTrigger = [...(calls.setNodeTrigger ?? []), [path, kind, config]]
+			return { path: `${path}_${kind}`, replaced: false }
+		},
 		testNode: async () => 'job-123',
 		...overrides
 	}
-	return { helpers: { pipeline }, calls }
+	return { helpers: { pipelines: () => [pipeline] }, calls }
 }
 
 describe('pipeline tools', () => {
@@ -78,6 +85,7 @@ describe('pipeline tools', () => {
 			'get_pipeline_graph',
 			'read_pipeline_node',
 			'remove_pipeline_node',
+			'set_pipeline_trigger',
 			'test_pipeline_node'
 		])
 	})
@@ -96,18 +104,25 @@ describe('pipeline tools', () => {
 
 	it('build_pipeline_node forwards to proposeNode and does not deploy', async () => {
 		const { helpers, calls } = makeHelpers()
+		const modified: string[] = []
 		const out = await toolByName('build_pipeline_node').fn({
 			args: {
 				path: 'f/analytics/clean',
 				language: 'bun',
+				summary: 'Test node',
 				content: '// pipeline\nexport async function main() {}',
 				output_kind: 'ducklake'
 			},
 			workspace: 'w',
 			helpers,
-			toolCallbacks: noopCallbacks(),
+			toolCallbacks: {
+				...noopCallbacks(),
+				onItemModified: (kind, path) => modified.push(`${kind}:${path}`)
+			},
 			toolId: 't'
 		})
+		// The session tracks the folder's draft bundle, the unit it deploys.
+		expect(modified).toEqual(['data_pipeline:f/analytics/data_pipeline'])
 		expect(calls.proposeNode?.[0]?.[0]).toMatchObject({
 			path: 'f/analytics/clean',
 			language: 'bun',
@@ -116,6 +131,99 @@ describe('pipeline tools', () => {
 		expect(out).toContain('not deployed')
 	})
 
+	it('build_pipeline_node attaches declared triggers, and flags one left unset', async () => {
+		const { helpers, calls } = makeHelpers({ unconfiguredTriggers: async () => ['kafka'] })
+		const out = await toolByName('build_pipeline_node').fn({
+			args: {
+				path: 'f/analytics/ingest',
+				language: 'python3',
+				summary: 'Test node',
+				content: '# pipeline\n# on schedule\n# on kafka\ndef main():\n    return 1',
+				triggers: [{ kind: 'schedule', config: { schedule: '0 0 6 * * *', timezone: 'UTC' } }]
+			},
+			workspace: 'w',
+			helpers,
+			toolCallbacks: noopCallbacks(),
+			toolId: 't'
+		})
+		expect(calls.setNodeTrigger?.[0]).toEqual([
+			'f/analytics/ingest',
+			'schedule',
+			{ args: {}, enabled: true, schedule: '0 0 6 * * *', timezone: 'UTC' }
+		])
+		expect(out).toContain("schedule 'f/analytics/ingest_schedule'")
+		expect(out).toContain('ACTION REQUIRED')
+		expect(out).toContain('set_pipeline_trigger')
+	})
+
+	it('build_pipeline_node rejects an invalid trigger config before staging the node', async () => {
+		const { helpers, calls } = makeHelpers()
+		await expect(
+			toolByName('build_pipeline_node').fn({
+				args: {
+					path: 'f/analytics/ingest',
+					language: 'python3',
+					summary: 'Test node',
+					content: '# pipeline\n# on schedule\ndef main():\n    return 1',
+					triggers: [{ kind: 'schedule', config: { timezone: 'UTC' } }]
+				},
+				workspace: 'w',
+				helpers,
+				toolCallbacks: noopCallbacks(),
+				toolId: 't'
+			})
+		).rejects.toThrow(/schedule/)
+		expect(calls.proposeNode).toBeUndefined()
+	})
+
+	it('build_pipeline_node keeps and records the node when a trigger fails to attach', async () => {
+		const { helpers, calls } = makeHelpers({
+			setNodeTrigger: async () => {
+				throw new Error('path taken')
+			}
+		})
+		const modified: string[] = []
+		const out = await toolByName('build_pipeline_node').fn({
+			args: {
+				path: 'f/analytics/ingest',
+				language: 'python3',
+				content: '# pipeline\n# on schedule\ndef main():\n    return 1',
+				summary: 'Ingest',
+				triggers: [{ kind: 'schedule', config: { schedule: '0 0 6 * * *', timezone: 'UTC' } }]
+			},
+			workspace: 'w',
+			helpers,
+			toolCallbacks: {
+				...noopCallbacks(),
+				onItemModified: (kind, path) => modified.push(`${kind}:${path}`)
+			},
+			toolId: 't'
+		})
+		expect(calls.proposeNode).toHaveLength(1)
+		expect(modified).toEqual(['data_pipeline:f/analytics/data_pipeline'])
+		expect(out).toContain('path taken')
+	})
+
+	it('build_pipeline_node refuses a trigger the content does not declare, before staging', async () => {
+		const { helpers, calls } = makeHelpers()
+		await expect(
+			toolByName('build_pipeline_node').fn({
+				args: {
+					path: 'f/analytics/ingest',
+					language: 'python3',
+					content: '# pipeline\ndef main():\n    return 1',
+					summary: 'Ingest',
+					triggers: [{ kind: 'schedule', config: { schedule: '0 0 6 * * *', timezone: 'UTC' } }]
+				},
+				workspace: 'w',
+				helpers,
+				toolCallbacks: noopCallbacks(),
+				toolId: 't'
+			})
+		).rejects.toThrow(/on schedule/)
+		expect(calls.proposeNode).toBeUndefined()
+	})
+
 	it('build_pipeline_node reports the inferred asset lineage', async () => {
 		const { helpers } = makeHelpers({
 			proposeNode: async (input) => ({
@@ -125,7 +233,12 @@ describe('pipeline tools', () => {
 			})
 		})
 		const out = await toolByName('build_pipeline_node').fn({
-			args: { path: 'f/analytics/clean', language: 'duckdb', content: '-- pipeline' },
+			args: {
+				path: 'f/analytics/clean',
+				language: 'duckdb',
+				content: '-- pipeline',
+				summary: 'Test node'
+			},
 			workspace: 'w',
 			helpers,
 			toolCallbacks: noopCallbacks(),
@@ -140,7 +253,12 @@ describe('pipeline tools', () => {
 			proposeNode: async (input) => ({ path: input.path, detectedReads: [], detectedWrites: [] })
 		})
 		const out = await toolByName('build_pipeline_node').fn({
-			args: { path: 'f/analytics/clean', language: 'duckdb', content: '-- pipeline' },
+			args: {
+				path: 'f/analytics/clean',
+				language: 'duckdb',
+				content: '-- pipeline',
+				summary: 'Test node'
+			},
 			workspace: 'w',
 			helpers,
 			toolCallbacks: noopCallbacks(),
@@ -164,6 +282,34 @@ describe('pipeline tools', () => {
 		expect(calls.editNode?.[0]?.[1]).toContain('const x = 42')
 	})
 
+	it('edit_pipeline_node renames a node by summary alone, and asks for one when missing', async () => {
+		const body = { language: 'bun' as const, content: 'const x = 1\n' }
+		const { helpers, calls } = makeHelpers({ getNodeBody: async () => body })
+		const run = (args: Record<string, unknown>) =>
+			toolByName('edit_pipeline_node').fn({
+				args: { path: 'f/analytics/orders', ...args },
+				workspace: 'w',
+				helpers,
+				toolCallbacks: noopCallbacks(),
+				toolId: 't'
+			})
+		await run({ summary: 'Clean orders' })
+		expect(calls.editNode?.[0]).toEqual(['f/analytics/orders', body.content, 'Clean orders'])
+
+		const bare = makeHelpers({
+			getNodeBody: async () => body,
+			editNode: async () => ({ summary: '', detectedReads: [], detectedWrites: [] })
+		})
+		const out = await toolByName('edit_pipeline_node').fn({
+			args: { path: 'f/analytics/orders', old_string: 'x = 1', new_string: 'x = 2' },
+			workspace: 'w',
+			helpers: bare.helpers,
+			toolCallbacks: noopCallbacks(),
+			toolId: 't'
+		})
+		expect(out).toContain('has no summary')
+	})
+
 	it('edit_pipeline_node surfaces a clear error when old_string is absent', async () => {
 		const { helpers } = makeHelpers({
 			getNodeBody: async () => ({ language: 'bun', content: 'const x = 1\n' })
@@ -182,7 +328,7 @@ describe('pipeline tools', () => {
 	it('mutation tools fail clearly when no pipeline editor is registered', async () => {
 		await expect(
 			toolByName('build_pipeline_node').fn({
-				args: { path: 'f/a/b', language: 'bun', content: 'x' },
+				args: { path: 'f/a/b', language: 'bun', content: 'x', summary: 'Test node' },
 				workspace: 'w',
 				helpers: {},
 				toolCallbacks: noopCallbacks(),
@@ -191,14 +337,114 @@ describe('pipeline tools', () => {
 		).rejects.toThrow(/No pipeline editor is open/)
 	})
 
+	it('remove_pipeline_node drops the pipeline from the changes once its last draft goes', async () => {
+		const run = async (hasDrafts: boolean) => {
+			const { helpers } = makeHelpers({ hasDrafts: () => hasDrafts })
+			const log: string[] = []
+			await toolByName('remove_pipeline_node').fn({
+				args: { path: 'f/analytics/clean' },
+				workspace: 'w',
+				helpers,
+				toolCallbacks: {
+					...noopCallbacks(),
+					onItemModified: (kind, path) => log.push(`modified ${kind}:${path}`),
+					onItemDiscarded: (kind, path) => log.push(`discarded ${kind}:${path}`)
+				},
+				toolId: 't'
+			})
+			return log
+		}
+		expect(await run(false)).toEqual(['discarded data_pipeline:f/analytics/data_pipeline'])
+		expect(await run(true)).toEqual(['modified data_pipeline:f/analytics/data_pipeline'])
+	})
+
 	it('test_pipeline_node requires confirmation', () => {
 		expect(toolByName('test_pipeline_node').requiresConfirmation).toBe(true)
 	})
 })
 
+describe('pipeline tools with several editors open', () => {
+	function editorFor(folder: string, built: string[]): PipelineAIChatHelpers {
+		return {
+			...makeHelpers().helpers.pipelines()[0],
+			getFolder: () => folder,
+			getPipelineContext: () => ({ ...sampleContext, folder }),
+			proposeNode: async (input) => {
+				built.push(`${folder}:${input.path}`)
+				return { path: input.path, detectedReads: [], detectedWrites: [] }
+			}
+		}
+	}
+	const call = (name: string, args: any, editors: PipelineAIChatHelpers[]) =>
+		toolByName(name).fn({
+			args,
+			workspace: 'w',
+			helpers: { pipelines: () => editors },
+			toolCallbacks: noopCallbacks(),
+			toolId: 't'
+		})
+
+	it('remounts an opened folder whose editor another tab replaced', async () => {
+		const built: string[] = []
+		const mounted: PipelineAIChatHelpers[] = []
+		const ensured: string[] = []
+		await toolByName('build_pipeline_node').fn({
+			args: {
+				path: 'f/sales/clean',
+				language: 'bun',
+				content: '// pipeline',
+				summary: 'Test node'
+			},
+			workspace: 'w',
+			helpers: {
+				pipelines: () => mounted,
+				pipelineFolders: () => ['sales'],
+				ensurePipeline: async (folder: string) => {
+					ensured.push(folder)
+					mounted.push(editorFor(folder, built))
+					return mounted[0]
+				}
+			},
+			toolCallbacks: noopCallbacks(),
+			toolId: 't'
+		})
+		expect(ensured).toEqual(['sales'])
+		expect(built).toEqual(['sales:f/sales/clean'])
+	})
+
+	it('routes a node to the editor of its folder', async () => {
+		const built: string[] = []
+		const editors = [editorFor('crm', built), editorFor('sales', built)]
+		await call(
+			'build_pipeline_node',
+			{ path: 'f/sales/clean', language: 'bun', content: '// pipeline', summary: 'Test node' },
+			editors
+		)
+		expect(built).toEqual(['sales:f/sales/clean'])
+		await expect(
+			call(
+				'build_pipeline_node',
+				{ path: 'f/other/clean', language: 'bun', content: '// pipeline', summary: 'Test node' },
+				editors
+			)
+		).rejects.toThrow(/open_preview\(kind="pipeline", path="other"\)/)
+	})
+
+	it('get_pipeline_graph needs the folder only when it is ambiguous', async () => {
+		const editors = [editorFor('crm', []), editorFor('sales', [])]
+		await expect(call('get_pipeline_graph', {}, editors)).rejects.toThrow(/pass the folder/)
+		expect(
+			JSON.parse(await call('get_pipeline_graph', { folder: 'f/sales' }, editors))
+		).toMatchObject({ folder: 'sales' })
+		expect(JSON.parse(await call('get_pipeline_graph', {}, [editors[0]]))).toMatchObject({
+			folder: 'crm'
+		})
+	})
+})
+
 describe('getPipelinePromptSection', () => {
 	it('names the active folder and the direct-draft workflow', () => {
-		const section = getPipelinePromptSection(sampleContext)
+		const section = getPipelinePromptSection([sampleContext.folder])
 		expect(section).toContain('/pipeline/analytics')
 		expect(section).toContain('build_pipeline_node')
 		expect(section).toContain('directly as unsaved drafts')
diff --git a/frontend/src/lib/components/copilot/chat/pipeline/core.ts b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
index a1a8f1ad6b..8d71b00279 100644
--- a/frontend/src/lib/components/copilot/chat/pipeline/core.ts
+++ b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
@@ -1,7 +1,8 @@
 import { z } from 'zod'
 import { $ScriptLang } from '$lib/gen/schemas.gen'
 import type { ScriptLang } from '$lib/gen'
-import { createToolDef, executeTestRun, findAndReplace } from '../shared'
+import { createToolDef, executeTestRun, findAndReplace, type ToolCallbacks } from '../shared'
+import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
 import {
 	NONE,
 	RUN_PREVIEW,
@@ -10,6 +11,11 @@ import {
 	type SessionTool
 } from '../sessionCapabilities'
 import type { PipelineOutputKind } from '$lib/components/assets/AssetGraph/pipelineTemplates'
+import type { PipelineTriggerDraftKind } from '$lib/components/assets/AssetGraph/types'
+import { DRAFTABLE_TRIGGER_KINDS } from '$lib/components/assets/AssetGraph/pipelineTriggerDrafts'
+import { scheduleRequestSchema, triggerRequestSchemas } from '../workspaceToolsZod.gen'
+import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
+import { parsePipelineAnnotations } from '$lib/components/assets/AssetGraph/parsePipelineAnnotations'
 
 // ============================================================================
 // Pipeline AI chat tools.
@@ -57,6 +63,10 @@ export type PipelineContext = {
  * small — the page owns the draft Map and canvas rendering.
  */
 export interface PipelineAIChatHelpers {
+	/** Folder name (no `f/` prefix) of the pipeline this editor shows. */
+	getFolder: () => string
+	/** Whether the folder has any script or trigger draft left. */
+	hasDrafts: () => boolean
 	getPipelineContext: () => PipelineContext
 	/** Read a node's source (the in-flight draft body if one exists, else deployed). */
 	getNodeBody: (path: string) => Promise<{ language: ScriptLang; content: string } | undefined>
@@ -68,29 +78,108 @@ export interface PipelineAIChatHelpers {
 		language: ScriptLang
 		content: string
 		outputKind?: PipelineOutputKind
+		summary?: string
 	}) => Promise<{ path: string; detectedReads: string[]; detectedWrites: string[] }>
 	/** Replace an existing node's body, applied as an unsaved draft. Returns the
 	 * re-inferred asset lineage (URIs) so the caller sees the effect of the edit. */
 	editNode: (
 		path: string,
-		content: string
-	) => Promise<{ detectedReads: string[]; detectedWrites: string[] }>
+		content: string,
+		summary?: string
+	) => Promise<{ summary: string; detectedReads: string[]; detectedWrites: string[] }>
 	/** Discard the unsaved draft at a path (undo a build_pipeline_node). */
 	removeProposedNode: (path: string) => Promise<void>
+	/** Trigger kinds the node declares (`on <kind>`) that no trigger row or draft fills. */
+	unconfiguredTriggers: (path: string) => Promise<PipelineTriggerDraftKind[]>
+	/** Attach (or replace) the node's trigger draft of that kind, deployed with the
+	 * pipeline. `config` is the kind's trigger config; path/script_path are filled in. */
+	setNodeTrigger: (
+		path: string,
+		kind: PipelineTriggerDraftKind,
+		config: Record<string, any>
+	) => Promise<{ path: string; replaced: boolean }>
 	/** Preview-run a node (draft body preferred). Returns the started job id. */
 	testNode: (path: string, args?: Record<string, any>) => Promise<string | undefined>
 }
 
-/** Helper bag the pipeline tools receive from the manager in global mode. */
-export type PipelineToolHelpers = { pipeline?: PipelineAIChatHelpers }
+/** Helper bag the pipeline tools receive from the manager in global mode: every
+ * pipeline editor currently open, one per folder. */
+export type PipelineToolHelpers = {
+	pipelines?: () => readonly PipelineAIChatHelpers[]
+	/** Folders the chat may work on, including ones whose editor is not mounted now. */
+	pipelineFolders?: () => readonly string[]
+	/** Remounts the folder's editor (a session reopens its preview tab) and resolves
+	 * to it, or `undefined` when it cannot be brought back. */
+	ensurePipeline?: (folder: string) => Promise<PipelineAIChatHelpers | undefined>
+}
 
-function requirePipeline(helpers: PipelineToolHelpers): PipelineAIChatHelpers {
-	if (!helpers?.pipeline) {
+/** The folder's editor, remounted when the chat opened it before and something else
+ * has taken its tab since. */
+async function remount(
+	helpers: PipelineToolHelpers,
+	folder: string | undefined
+): Promise<PipelineAIChatHelpers | undefined> {
+	if (!folder || !helpers?.ensurePipeline) return undefined
+	if (!(helpers.pipelineFolders?.() ?? []).includes(folder)) return undefined
+	return helpers.ensurePipeline(folder)
+}
+
+function openPipelines(helpers: PipelineToolHelpers): readonly PipelineAIChatHelpers[] {
+	const open = helpers?.pipelines?.() ?? []
+	if (open.length === 0) {
 		throw new Error(
 			'No pipeline editor is open. Pipeline tools only work on a /pipeline/<folder> page in edit mode.'
 		)
 	}
-	return helpers.pipeline
+	return open
+}
+
+function notOpenError(folder: string, open: readonly PipelineAIChatHelpers[]): Error {
+	const names = open.map((p) => `'${p.getFolder()}'`).join(', ')
+	return new Error(
+		`No pipeline editor is open for folder '${folder}' (open: ${names}). Open it with open_preview(kind="pipeline", path="${folder}") first.`
+	)
+}
+
+/** The editor of the pipeline a node path belongs to (`f/<folder>/<node>`). With a
+ * single editor open, a path outside it still goes to that editor, whose own check
+ * names the corrected path. */
+async function pipelineForPath(
+	helpers: PipelineToolHelpers,
+	path: string
+): Promise<PipelineAIChatHelpers> {
+	const folder = path.match(/^f\/([^/]+)\//)?.[1]
+	const live = folder ? helpers?.pipelines?.().find((p) => p.getFolder() === folder) : undefined
+	const match = live ?? (await remount(helpers, folder))
+	if (match) return match
+	const open = openPipelines(helpers)
+	if (open.length === 1) return open[0]
+	throw folder
+		? notOpenError(folder, open)
+		: new Error(
+				`'${path}' is not a pipeline node path — nodes live at f/<folder>/<node_name>, with <folder> one of: ${open.map((p) => `'${p.getFolder()}'`).join(', ')}.`
+			)
+}
+
+async function pipelineForFolder(
+	helpers: PipelineToolHelpers,
+	folder: string | undefined
+): Promise<PipelineAIChatHelpers> {
+	const known = helpers?.pipelineFolders?.() ?? []
+	const name = folder ? normalizePipelineFolder(folder) : known.length === 1 ? known[0] : undefined
+	const live = name ? helpers?.pipelines?.().find((p) => p.getFolder() === name) : undefined
+	const remounted = live ?? (await remount(helpers, name))
+	if (remounted) return remounted
+	const open = openPipelines(helpers)
+	if (folder) {
+		const match = open.find((p) => p.getFolder() === name)
+		if (!match) throw notOpenError(normalizePipelineFolder(folder), open)
+		return match
+	}
+	if (open.length === 1) return open[0]
+	throw new Error(
+		`Several pipeline editors are open (${open.map((p) => `'${p.getFolder()}'`).join(', ')}) — pass the folder to read.`
+	)
 }
 
 const scriptLangSchema = z.enum($ScriptLang.enum)
@@ -105,12 +194,20 @@ const outputKindSchema = z
 // Read tools
 // ----------------------------------------------------------------------------
 
-const getPipelineGraphSchema = z.object({})
+const getPipelineGraphSchema = z.object({
+	folder: z
+		.string()
+		.optional()
+		.describe(
+			'Folder of the pipeline to read (e.g. `analytics`). Required when several pipeline editors are open; may be omitted when only one is.'
+		)
+})
 
 const getPipelineGraphToolDef = createToolDef(
 	getPipelineGraphSchema,
 	'get_pipeline_graph',
-	"Read the live pipeline graph for the open /pipeline/<folder> editor: its nodes (scripts), each node's language, asset reads/writes, declared triggers, and whether it has an unsaved draft edit. Call this before building or editing nodes so you reuse existing assets/paths and understand the current DAG."
+	"Read the live pipeline graph of an open /pipeline/<folder> editor: its nodes (scripts), each node's language, asset reads/writes, declared triggers, and whether it has an unsaved draft edit. Call this before building or editing nodes so you reuse existing assets/paths and understand the current DAG.",
+	{ strict: false }
 )
 
 const readPipelineNodeSchema = z.object({
@@ -127,11 +224,75 @@ const readPipelineNodeToolDef = createToolDef(
 // Mutation tools (apply directly as unsaved drafts; never deploy)
 // ----------------------------------------------------------------------------
 
+const triggerKindEnum = z.enum(DRAFTABLE_TRIGGER_KINDS as [PipelineTriggerDraftKind, ...PipelineTriggerDraftKind[]])
+
+const nodeTriggerSchema = z.object({
+	kind: triggerKindEnum.describe('Trigger kind; the node must declare `on <kind>`.'),
+	config: z
+		.record(z.string(), z.any())
+		.describe(
+			'The trigger configuration. schedule: { schedule (6-field cron, e.g. "0 0 6 * * *"), timezone (IANA, e.g. "UTC"), args? (the node\'s inputs), summary? }. Any other kind: the fields get_trigger_schema returns for it. path, script_path and is_flow are filled in; pass path only to name the trigger yourself.'
+		)
+})
+
+const setPipelineTriggerSchema = nodeTriggerSchema.extend({
+	path: z.string().describe('Workspace path of the node the trigger runs.')
+})
+
+const setPipelineTriggerToolDef = createToolDef(
+	setPipelineTriggerSchema,
+	'set_pipeline_trigger',
+	'Attach the trigger a node declares with `on <schedule|email|kafka|mqtt|amqp|nats|postgres|sqs|gcp>` (its cron, topic, queue…) as an unsaved trigger draft, deployed together with the pipeline. Calling it again for the same node and kind replaces that draft. Webhook and data_upload need no trigger.',
+	{ strict: false }
+)
+
+/** Validates a node trigger's config against the kind's request schema, with the
+ * fields the pipeline fills in present so they are not reported missing. */
+function validateTriggerConfig(
+	kind: PipelineTriggerDraftKind,
+	config: Record<string, any>,
+	nodePath: string
+): Record<string, any> {
+	const filled = { path: `${nodePath}_${kind}`, script_path: nodePath, is_flow: false, ...config }
+	if (kind === 'schedule') {
+		const parsed = scheduleRequestSchema.safeParse({ args: {}, enabled: true, ...filled })
+		if (!parsed.success) {
+			throw new Error(
+				`Invalid schedule config: ${parsed.error.issues.map((i) => `${i.path.join('.') || '<root>'}: ${i.message}`).join('; ')}`
+			)
+		}
+		return { args: {}, enabled: true, ...config }
+	}
+	const parsed = triggerRequestSchemas[kind].safeParse(filled)
+	if (!parsed.success) {
+		throw new Error(
+			`Invalid config for a "${kind}" trigger. Call get_trigger_schema with kind "${kind}" for its exact fields. Issues: ${parsed.error.issues.map((i) => `${i.path.join('.') || '<root>'}: ${i.message}`).join('; ')}`
+		)
+	}
+	return config
+}
+
+/** The note every node write ends with while a declared trigger is still unset: the
+ * node would deploy with nothing to start it. */
+function unconfiguredTriggersNote(path: string, kinds: readonly string[]): string {
+	if (kinds.length === 0) return ''
+	return ` ACTION REQUIRED: '${path}' declares \`on ${kinds.join('`, `on ')}\` but has no ${kinds.join('/')} trigger yet, so nothing would start it once deployed. Call set_pipeline_trigger for it now (a schedule needs its cron and timezone; ask the user only if the cadence cannot be inferred).`
+}
+
+const summaryField = z
+	.string()
+	.trim()
+	.min(1)
+	.max(80)
+	.describe(
+		'Succinct summary of what the node does, a few words in sentence case with no trailing period (e.g. "Ingest Stripe charges", "Daily revenue by region"). It is the title the node shows in the workspace.'
+	)
+
 const buildPipelineNodeSchema = z.object({
 	path: z
 		.string()
 		.describe(
-			"Workspace path for the new node, e.g. f/<folder>/<name>. Use the open pipeline's folder. Must not collide with an existing node."
+			'Workspace path for the new node, e.g. f/<folder>/<name>, in the folder of an open pipeline editor. Must not collide with an existing node.'
 		),
 	language: scriptLangSchema.describe(
 		'Script language. SQL-shaped data work uses duckdb (DuckLake/S3) or postgresql (data tables); bun/python3 for general transforms.'
@@ -141,7 +302,14 @@ const buildPipelineNodeSchema = z.object({
 		.describe(
 			"Full script source. Start it with the `pipeline` annotation as a top-of-file comment in the LANGUAGE'S comment syntax — `-- pipeline` for SQL (duckdb/postgresql), `# pipeline` for python3/bash, `// pipeline` for bun/TS — to mark it a pipeline member; declare inputs the same way (e.g. `-- on <asset-uri|schedule|webhook|...>`), and write outputs via the wmill SDK / SQL so the lineage edges are inferred. A `// pipeline` line in a SQL node is a syntax error. Read existing node bodies first to match conventions."
 		),
-	output_kind: outputKindSchema.optional()
+	summary: summaryField,
+	output_kind: outputKindSchema.optional(),
+	triggers: z
+		.array(nodeTriggerSchema)
+		.optional()
+		.describe(
+			'Triggers for the `on <kind>` lines the content declares (schedule, email, kafka, …), attached as trigger drafts in the same step. Every such declaration needs one; webhook and data_upload need none.'
+		)
 })
 
 const buildPipelineNodeToolDef = createToolDef(
@@ -153,8 +321,17 @@ const buildPipelineNodeToolDef = createToolDef(
 
 const editPipelineNodeSchema = z.object({
 	path: z.string().describe('Workspace path of the node to edit.'),
-	old_string: z.string().min(1).describe("Exact text to find in the node's current source."),
-	new_string: z.string().describe('Replacement text.'),
+	old_string: z
+		.string()
+		.min(1)
+		.optional()
+		.describe("Exact text to find in the node's current source. Omit to change only the summary."),
+	new_string: z.string().optional().describe('Replacement text.'),
+	summary: summaryField
+		.optional()
+		.describe(
+			'New succinct summary (a few words, no trailing period). Pass it whenever the node has none or the edit changes what the node does.'
+		),
 	replace_all: z
 		.boolean()
 		.optional()
@@ -197,6 +374,12 @@ const testPipelineNodeToolDef = createToolDef(
 	{ strict: false }
 )
 
+// A pipeline's drafts are one bundle for the whole folder, so that bundle is the
+// item a node edit marks as modified — it is what the session deploys as a unit.
+function recordPipelineModified(toolCallbacks: ToolCallbacks, pipeline: PipelineAIChatHelpers) {
+	toolCallbacks.onItemModified?.(PIPELINE_DRAFT_KIND, pipelineBundlePath(pipeline.getFolder()))
+}
+
 // Summarize the asset lineage the parser inferred from a just-applied node so the
 // model gets same-turn feedback on whether its intended edges formed. An empty
 // result is the useful signal: a write/read expressed via a variable or dynamic
@@ -217,8 +400,9 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
 		requires: NONE,
 		def: getPipelineGraphToolDef,
 		planModeSafe: true,
-		fn: async ({ helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
+		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
+			const { folder } = getPipelineGraphSchema.parse(args ?? {})
+			const pipeline = await pipelineForFolder(helpers, folder)
 			toolCallbacks.setToolStatus(toolId, { content: 'Reading pipeline graph...' })
 			const ctx = pipeline.getPipelineContext()
 			toolCallbacks.setToolStatus(toolId, {
@@ -233,8 +417,8 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
 		def: readPipelineNodeToolDef,
 		planModeSafe: true,
 		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
 			const { path } = readPipelineNodeSchema.parse(args)
+			const pipeline = await pipelineForPath(helpers, path)
 			toolCallbacks.setToolStatus(toolId, { content: `Reading node '${path}'...` })
 			const node = await pipeline.getNodeBody(path)
 			if (!node) {
@@ -251,20 +435,51 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
 		showDetails: true,
 		showFade: true,
 		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
-			const { path, language, content, output_kind } = buildPipelineNodeSchema.parse(args)
+			const { path, language, content, summary, output_kind, triggers } =
+				buildPipelineNodeSchema.parse(args)
+			const pipeline = await pipelineForPath(helpers, path)
+			// Checked before the node is staged, so a bad trigger leaves nothing half-built.
+			const declared = new Set(parsePipelineAnnotations(content).nativeTriggers.map((n) => n.kind))
+			const configs = (triggers ?? []).map((t) => {
+				if (!declared.has(t.kind)) {
+					throw new Error(
+						`The content declares no \`on ${t.kind}\`, so a ${t.kind} trigger has nothing to bind to. Add the annotation line or drop that trigger. Nothing was built.`
+					)
+				}
+				return { kind: t.kind, config: validateTriggerConfig(t.kind, t.config, path) }
+			})
 			toolCallbacks.setToolStatus(toolId, { content: `Building node '${path}'...` })
 			const { detectedReads, detectedWrites } = await pipeline.proposeNode({
 				path,
 				language: language as ScriptLang,
 				content,
+				summary,
 				outputKind: output_kind as PipelineOutputKind | undefined
 			})
+			// Recorded as soon as it is staged: a trigger that fails below leaves the node.
+			recordPipelineModified(toolCallbacks, pipeline)
+			const attached: string[] = []
+			const failed: string[] = []
+			for (const t of configs) {
+				try {
+					const { path: triggerPath } = await pipeline.setNodeTrigger(path, t.kind, t.config)
+					attached.push(`${t.kind} '${triggerPath}'`)
+				} catch (e) {
+					failed.push(`${t.kind}: ${e instanceof Error ? e.message : String(e)}`)
+				}
+			}
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Added draft node '${path}'`,
 				result: 'Success'
 			})
-			return `Pipeline node '${path}' added as an unsaved draft on the canvas. It is not deployed — the user deploys it.${inferredLineageNote(detectedReads, detectedWrites)}`
+			const attachedNote =
+				(attached.length
+					? ` Attached trigger draft${attached.length > 1 ? 's' : ''}: ${attached.join(', ')}.`
+					: '') +
+				(failed.length
+					? ` The node was built, but these triggers were not attached — fix them with set_pipeline_trigger: ${failed.join('; ')}.`
+					: '')
+			return `Pipeline node '${path}' added as an unsaved draft on the canvas. It is not deployed — the user deploys it.${attachedNote}${inferredLineageNote(detectedReads, detectedWrites)}${unconfiguredTriggersNote(path, await pipeline.unconfiguredTriggers(path))}`
 		}
 	},
 	{
@@ -274,36 +489,74 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
 		showDetails: true,
 		showFade: true,
 		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
-			const { path, old_string, new_string, replace_all } = editPipelineNodeSchema.parse(args)
+			const { path, old_string, new_string, replace_all, summary } =
+				editPipelineNodeSchema.parse(args)
+			if (old_string === undefined && summary === undefined) {
+				throw new Error('Pass old_string/new_string to change the source, summary to rename it, or both.')
+			}
+			const pipeline = await pipelineForPath(helpers, path)
 			const node = await pipeline.getNodeBody(path)
 			if (!node) {
 				return `No pipeline node found at '${path}'. Call get_pipeline_graph to list the available nodes.`
 			}
 			toolCallbacks.setToolStatus(toolId, { content: `Editing node '${path}'...` })
-			const updated = findAndReplace(
-				node.content,
-				old_string,
-				new_string,
-				replace_all ?? false,
-				'node source'
-			)
-			const { detectedReads, detectedWrites } = await pipeline.editNode(path, updated)
+			const updated =
+				old_string === undefined
+					? node.content
+					: findAndReplace(
+							node.content,
+							old_string,
+							new_string ?? '',
+							replace_all ?? false,
+							'node source'
+						)
+			const edited = await pipeline.editNode(path, updated, summary)
+			const { detectedReads, detectedWrites } = edited
+			const summaryNote = edited.summary.trim()
+				? ''
+				: ` '${path}' has no summary: call edit_pipeline_node with just \`summary\` (a few words saying what it does).`
+			recordPipelineModified(toolCallbacks, pipeline)
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Edited draft '${path}'`,
 				result: 'Success'
 			})
-			return `Pipeline node '${path}' updated as an unsaved draft on the canvas (not deployed).${inferredLineageNote(detectedReads, detectedWrites)}`
+			return `Pipeline node '${path}' updated as an unsaved draft on the canvas (not deployed).${inferredLineageNote(detectedReads, detectedWrites)}${summaryNote}${unconfiguredTriggersNote(path, await pipeline.unconfiguredTriggers(path))}`
+		}
+	},
+	{
+		requires: WRITE_DRAFT,
+		def: setPipelineTriggerToolDef,
+		showDetails: true,
+		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
+			const { path, kind, config } = setPipelineTriggerSchema.parse(args)
+			const pipeline = await pipelineForPath(helpers, path)
+			toolCallbacks.setToolStatus(toolId, { content: `Setting the ${kind} trigger of '${path}'...` })
+			const valid = validateTriggerConfig(kind, config, path)
+			const { path: triggerPath, replaced } = await pipeline.setNodeTrigger(path, kind, valid)
+			recordPipelineModified(toolCallbacks, pipeline)
+			toolCallbacks.setToolStatus(toolId, {
+				content: `${replaced ? 'Updated' : 'Attached'} ${kind} trigger '${triggerPath}'`,
+				result: 'Success'
+			})
+			return `${replaced ? 'Replaced' : 'Attached'} the ${kind} trigger draft '${triggerPath}' on '${path}'. It deploys with the pipeline.${unconfiguredTriggersNote(path, await pipeline.unconfiguredTriggers(path))}`
 		}
 	},
 	{
 		requires: WRITE_DRAFT,
 		def: removePipelineNodeToolDef,
 		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
 			const { path } = removePipelineNodeSchema.parse(args)
+			const pipeline = await pipelineForPath(helpers, path)
 			toolCallbacks.setToolStatus(toolId, { content: `Discarding draft '${path}'...` })
 			await pipeline.removeProposedNode(path)
+			// With the last draft gone there is nothing left to deploy: the pipeline
+			// is no longer this chat's change, and listing it would show it deployed.
+			if (pipeline.hasDrafts()) recordPipelineModified(toolCallbacks, pipeline)
+			else
+				toolCallbacks.onItemDiscarded?.(
+					PIPELINE_DRAFT_KIND,
+					pipelineBundlePath(pipeline.getFolder())
+				)
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Discarded draft '${path}'`,
 				result: 'Success'
@@ -319,8 +572,8 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
 		showDetails: true,
 		autoCollapseDetails: false,
 		fn: async ({ args, workspace, helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
 			const { path, args: runArgs } = testPipelineNodeSchema.parse(args)
+			const pipeline = await pipelineForPath(helpers, path)
 			return executeTestRun({
 				jobStarter: async () => {
 					const jobId = await pipeline.testNode(path, runArgs ?? undefined)
@@ -350,22 +603,35 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
  * since the tools it names are withheld from that session; the annotation model stays,
  * as it is what lets the model read and explain an existing pipeline.
  */
-export function getPipelinePromptSection(ctx: PipelineContext, access?: SessionAccess): string {
+export function getPipelinePromptSection(
+	folders: readonly string[],
+	access?: SessionAccess
+): string {
 	const canWriteDraft = !access || access.has('write_draft')
+	const [first] = folders
+	const openLine =
+		folders.length === 1
+			? `The user has the /pipeline/${first} editor open.`
+			: `The user has ${folders.length} pipeline editors open: ${folders.map((f) => `/pipeline/${f}`).join(', ')}. Each tool acts on the pipeline its node path's folder names; pass \`folder\` to get_pipeline_graph.`
+	const pathLine =
+		folders.length === 1
+			? `Every node of this pipeline lives at \`f/${first}/<node_name>\` — \`${first}\` is the folder name and \`f/\` is the owner prefix every workspace path carries, so write it exactly once (never \`f/f/…\`, and never a bare \`<node_name>\`).`
+			: `Every node of a pipeline lives at \`f/<folder>/<node_name>\` (e.g. \`f/${first}/<node_name>\`) — \`f/\` is the owner prefix every workspace path carries, so write it exactly once (never \`f/f/…\`, and never a bare \`<node_name>\`). A node can only be built in the folder of an open pipeline editor.`
 	return `
 
 Data Pipeline editor (ACTIVE):
-- The user has the /pipeline/${ctx.folder} editor open. A pipeline is a DAG of scripts (nodes) connected by storage assets (DuckLake tables, data tables, S3 objects, volumes, resources) and execution triggers.
+- ${openLine} A pipeline is a DAG of scripts (nodes) connected by storage assets (DuckLake tables, data tables, S3 objects, volumes, resources) and execution triggers.
 - Annotations are top-of-file comments in the NODE'S OWN comment syntax: \`--\` for SQL (duckdb/postgresql), \`#\` for python3/bash, \`//\` for bun/TS. The \`//\` shown below is the TS form — translate it (a \`// pipeline\` line in a SQL node is a syntax error that won't deploy).
 - A script becomes a pipeline node when its source starts with the \`// pipeline\` annotation. Declare execution-DAG inputs with \`// on <asset-uri | schedule | webhook | email | kafka | mqtt | amqp | nats | postgres | sqs | gcp | data_upload>\` (e.g. \`// on ducklake://main/orders\`). Outputs are inferred from what the body writes (wmill SDK calls / SQL CREATE TABLE / writeS3File); declare a managed output with \`// materialize <asset-uri>\`. Optional badges: \`// partitioned <daily|hourly|weekly|monthly|dynamic>\`, \`// freshness <duration>\`, \`// tag <name>\`, \`// retry <count> [delay]\`, \`// data_test <kind> ...\` (managed DuckLake targets only — deploy rejects it beside a \`dbt://\` target), \`// measure <name> = <agg> [where <pred>]\`, \`// dimension <name> = <expr>\`.
-- \`materialize\` (the managed output): a managed \`// materialize ducklake://<name>/<table>\` means the runtime writes the node's output table FOR you — write the body as a single SELECT and the runtime wraps it in the create/replace, so do NOT also write your own CREATE TABLE / INSERT. The \`dbt://\` target below is the opposite: the node writes its own DDL and none of the write strategies apply to it. IMPORTANT: a MANAGED \`// materialize\` is **DuckDB-only** and its target MUST be a DuckLake table (\`ducklake://<name>/<table>\`) — deploy rejects a \`ducklake://\` target on any other language. For a \`python3\`/\`bun\`/\`postgresql\` node writing the lake, do NOT use \`// materialize\`; write the output via the SDK instead (e.g. \`wmill.writeS3File(...)\`, a \`CREATE TABLE\` in postgresql, or \`wmill.databaseUrlFromResource\`/ducklake helpers) and let the output be inferred. Reach for \`duckdb\` when a node should materialize a DuckLake table. The one target any language BUT DBT'S OWN may declare (a dbt project's writes come from its manifest, so \`// materialize\` on a dbt script is rejected at deploy) is a WAREHOUSE RELATION: \`// materialize manual dbt://<warehouse>/<schema>/<name>\`, with \`<warehouse>\` a warehouse the workspace configures under Settings → dbt. \`manual\` is its only mode — nothing generates warehouse DDL, so the node issues its own write and the annotation records the outcome. Use it on an ingestion node a dbt project reads as a \`source\`: the declared relation and the dbt model become ONE graph node, and a downstream \`// on dbt://<warehouse>/<schema>/<name>\` fires when that node completes. Write strategy: with no option it REPLACES the whole table each run (full refresh; the only mode whose output columns may change); \`// materialize <uri> append\` INSERT-appends rows (incremental); \`// materialize <uri> key=<col>\` merges/upserts on \`<col>\`. \`// materialize manual <uri>\` opts OUT of managed writes — the script writes its own DDL and the annotation only records the output asset for lineage. \`materialize\` is paired with partitioning for incremental pipelines: a \`// partitioned <daily|hourly|weekly|monthly|dynamic>\` node runs once per partition (append/merge into a fixed-schema table), and the \`{partition}\` token — usable in any asset URI AND in the body SQL — is substituted with the current partition's IDENTITY string at run time. To filter the source to the active slice on a time grain, use the runtime-injected macro: \`WHERE wm_partition(<ts_col>) = {partition}\`. \`wm_partition(ts)\` buckets a timestamp with the exact identity format the runtime used (daily/hourly/weekly/monthly), so it always matches and you never hand-write a \`strftime\` format. Do NOT write \`= TIMESTAMP {partition}\`: the identity string is not a valid timestamp literal for hourly/weekly/monthly and errors at runtime. For \`dynamic\` partitioning the identity is your caller-supplied key (not a timestamp, no macro), so filter on it directly: \`WHERE <your_key_col> = {partition}\`. \`materialize\` is an output DECLARATION on the node — it is not a command; there is no "materialize run".
+- \`materialize\` (the managed output): a managed \`// materialize ducklake://<name>/<table>\` means the runtime writes the node's output table FOR you — write the body as a single SELECT and the runtime wraps it in the create/replace, so do NOT also write your own CREATE TABLE / INSERT. The \`dbt://\` target below is the opposite: the node writes its own DDL and none of the write strategies apply to it. IMPORTANT: a MANAGED \`// materialize\` is **DuckDB-only** and its target MUST be a DuckLake table (\`ducklake://<name>/<table>\`) — deploy rejects a \`ducklake://\` target on any other language. For a \`python3\`/\`bun\`/\`postgresql\` node writing the lake, do NOT use \`// materialize\`; write the table straight into DuckLake with \`wmill.ducklake()\` (or a data table with \`wmill.datatable()\`), or a \`CREATE TABLE\` in postgresql and let the output be inferred. Reach for \`duckdb\` when a node should materialize a DuckLake table. The one target any language BUT DBT'S OWN may declare (a dbt project's writes come from its manifest, so \`// materialize\` on a dbt script is rejected at deploy) is a WAREHOUSE RELATION: \`// materialize manual dbt://<warehouse>/<schema>/<name>\`, with \`<warehouse>\` a warehouse the workspace configures under Settings → dbt. \`manual\` is its only mode — nothing generates warehouse DDL, so the node issues its own write and the annotation records the outcome. Use it on an ingestion node a dbt project reads as a \`source\`: the declared relation and the dbt model become ONE graph node, and a downstream \`// on dbt://<warehouse>/<schema>/<name>\` fires when that node completes. Write strategy: with no option it REPLACES the whole table each run (full refresh; the only mode whose output columns may change); \`// materialize <uri> append\` INSERT-appends rows (incremental); \`// materialize <uri> key=<col>\` merges/upserts on \`<col>\`. \`// materialize manual <uri>\` opts OUT of managed writes — the script writes its own DDL and the annotation only records the output asset for lineage. \`materialize\` is paired with partitioning for incremental pipelines: a \`// partitioned <daily|hourly|weekly|monthly|dynamic>\` node runs once per partition (append/merge into a fixed-schema table), and the \`{partition}\` token — usable in any asset URI AND in the body SQL — is substituted with the current partition's IDENTITY string at run time. To filter the source to the active slice on a time grain, use the runtime-injected macro: \`WHERE wm_partition(<ts_col>) = {partition}\`. \`wm_partition(ts)\` buckets a timestamp with the exact identity format the runtime used (daily/hourly/weekly/monthly), so it always matches and you never hand-write a \`strftime\` format. Do NOT write \`= TIMESTAMP {partition}\`: the identity string is not a valid timestamp literal for hourly/weekly/monthly and errors at runtime. For \`dynamic\` partitioning the identity is your caller-supplied key (not a timestamp, no macro), so filter on it directly: \`WHERE <your_key_col> = {partition}\`. \`materialize\` is an output DECLARATION on the node — it is not a command; there is no "materialize run".
 - \`measure\` / \`dimension\` (declared metrics): on a node that materializes a DuckLake table, \`// measure <name> = <aggregate> [where <predicate>]\` names the canonical way to aggregate that table (e.g. \`// measure revenue = sum(amount) where not is_refund\`), and \`// dimension <name> = <expr>\` names a way to slice it (e.g. \`// dimension region = region\`, \`// dimension month = date_trunc('month', ordered_at)\`). They execute nothing: they are catalogued at deploy so the editor and other agents can reuse the definition instead of re-deriving it and silently disagreeing. Keep the predicate in the \`where\` clause rather than folding it into the aggregate: it is rendered as \`<agg> FILTER (WHERE <pred>)\`, which is what lets two measures with different predicates sit under one GROUP BY. DuckLake-only, and only meaningful next to \`// materialize\`. Declare one when a number carries a judgement call someone else would get wrong (refunds excluded, test rows dropped, which column is the amount); do NOT blanket every table with measures, an obvious \`count(*)\` earns nothing. To USE a metric another node declares, read that node with read_pipeline_node and reuse its exact expression rather than guessing it.
 - Use get_pipeline_graph to see the current nodes/assets/triggers, and read_pipeline_node before editing one.
-- Every node of this pipeline lives at \`f/${ctx.folder}/<node_name>\` — \`${ctx.folder}\` is the folder name and \`f/\` is the owner prefix every workspace path carries, so write it exactly once (never \`f/f/…\`, and never a bare \`<node_name>\`).${
+- ${pathLine}${
 		canWriteDraft
 			? `
-- Build new nodes with build_pipeline_node and edit existing ones with edit_pipeline_node. These apply directly as unsaved drafts on the canvas (like the flow/script editor applies AI edits) — they DO NOT deploy. There is no separate Accept/Reject step. Prefer these over the generic write_script/edit_script draft tools while a pipeline is open.
+- Build new nodes with build_pipeline_node and edit existing ones with edit_pipeline_node. Give every node a succinct \`summary\` (a few words saying what it does, e.g. "Ingest Stripe charges"), and update it when an edit changes what the node does. These apply directly as unsaved drafts on the canvas (like the flow/script editor applies AI edits) — they DO NOT deploy. There is no separate Accept/Reject step. Prefer these over the generic write_script/edit_script draft tools while a pipeline is open.
 - Reuse existing asset paths from the graph when wiring a downstream node to an upstream one (read the upstream's write asset, then \`// on\` that same URI).
+- TRIGGERS: an ingestion node (one with no upstream asset to react to) must declare how it starts, e.g. \`// on schedule\`, and every \`on <schedule|email|kafka|mqtt|amqp|nats|postgres|sqs|gcp>\` line needs its trigger: pass it in build_pipeline_node's \`triggers\` (or call set_pipeline_trigger) in the same step you build the node. A schedule needs a 6-field cron and an IANA timezone — pick a sensible cadence from the request (e.g. daily at 06:00 UTC for a daily sync) rather than leaving it empty; for the other kinds call get_trigger_schema(kind) for the config fields and ask the user for any connection/resource you cannot find. Never leave a declared trigger without one: the node would deploy with nothing to start it. \`webhook\` and \`data_upload\` need no trigger.
 - Only deploy when the user explicitly asks; the user deploys drafts from the canvas.`
 			: ''
 	}`
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index ff7c59d6cb..5a3427006e 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -395,6 +395,30 @@ describe('processToolCall', () => {
 		expect(result.content).toBe(`Error while calling tool: ${expectedError}`)
 	})
 
+	it('resolves a tool registered earlier in the same batch from the live set', async () => {
+		const { createToolDef, processToolCall } = await import('./shared')
+		const fn = vi.fn().mockResolvedValue('built')
+		const registered = {
+			def: createToolDef(z.object({}), 'build_pipeline_node', 'Build node'),
+			fn
+		}
+		const result = await processToolCall({
+			tools: [],
+			live: () => ({ tools: [registered], helpers: { pipelines: true } }),
+			toolCall: {
+				id: 'call_live',
+				type: 'function',
+				function: { name: 'build_pipeline_node', arguments: '{}' }
+			},
+			helpers: {},
+			workspace: 'test-workspace',
+			toolCallbacks: { setToolStatus: vi.fn(), removeToolStatus: vi.fn() }
+		})
+
+		expect(result.content).toBe('built')
+		expect(fn).toHaveBeenCalledWith(expect.objectContaining({ helpers: { pipelines: true } }))
+	})
+
 	it('continues to confirmation when pre-confirmation validation passes', async () => {
 		const { createToolDef, processToolCall } = await import('./shared')
 		const fn = vi.fn().mockResolvedValue('ok')
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 6897a22444..f346b4297d 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -834,6 +834,13 @@ async function callTool<T>({
 }): Promise<string> {
 	const tool = tools.find((t) => t.def.function.name === functionName)
 	if (!tool) {
+		// The pipeline tools exist only while a pipeline editor is mounted, and change_mode
+		// cannot mount one, so the generic hint would send the model probing.
+		if (/_pipeline_node$|^get_pipeline_graph$/.test(functionName)) {
+			throw new Error(
+				`${functionName} is not available yet: no pipeline editor is open for this chat. Call open_preview(kind="pipeline", path="<folder>") first and wait for its result; once it reports the editor open, the pipeline tools are callable. Do not fall back to write_script.`
+			)
+		}
 		throw new Error(
 			`Unknown tool call: ${functionName}. Probably not in the correct mode, use the change_mode tool to switch to the correct mode.`
 		)
@@ -924,22 +931,33 @@ type ToolCallStatus =
 	| 'blocked_plan_mode'
 	| 'held_for_instructions'
 
+/** Re-reads the chat loop's current tools and helpers. A call earlier in the same
+ * response can register tools (open_preview mounting the pipeline editor, change_mode),
+ * so a later call in that batch must resolve against the live set, not the snapshot the
+ * response was requested with. */
+export type LiveToolSet = () => { tools: Tool<any>[]; helpers: any }
+
 export async function processToolCall<T>({
-	tools,
+	tools: snapshotTools,
 	toolCall,
-	helpers,
+	helpers: snapshotHelpers,
 	toolCallbacks,
 	workspace,
-	messages = []
+	messages = [],
+	live
 }: {
 	tools: Tool<T>[]
 	toolCall: ChatCompletionMessageFunctionToolCall
 	helpers: T
+	live?: LiveToolSet
 	toolCallbacks: ToolCallbacks
 	workspace?: string
 	/** The conversation so far, for which folder instructions it already carries. */
 	messages?: readonly ChatCompletionMessageParam[]
 }): Promise<ChatCompletionMessageParam> {
+	const current = live?.()
+	const tools: Tool<T>[] = current?.tools ?? snapshotTools
+	const helpers: T = current ? current.helpers : snapshotHelpers
 	const tool = tools.find((t) => t.def.function.name === toolCall.function.name)
 	const workspaceId = workspace ?? get(workspaceStore) ?? ''
 
diff --git a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
index fc019ee983..0b393e6969 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
@@ -28,9 +28,9 @@ export const scheduleRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -80,9 +80,9 @@ export const httpTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -139,9 +139,9 @@ export const websocketTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -185,9 +185,9 @@ export const kafkaTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -217,9 +217,9 @@ export const natsTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -258,9 +258,9 @@ export const postgresTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -300,9 +300,9 @@ export const mqttTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -337,9 +337,9 @@ export const amqpTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -368,9 +368,9 @@ export const sqsTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -408,9 +408,9 @@ export const gcpTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -442,9 +442,9 @@ export const azureTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -470,9 +470,9 @@ export const emailTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index c53028031d..a9a33e9deb 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -32,6 +32,7 @@ import { formatResourceTypes } from './utils'
 import {
 	appendPendingToolImages,
 	processToolCall,
+	type LiveToolSet,
 	queuedToolStatus,
 	type Tool,
 	type ToolCallbacks
@@ -71,6 +72,7 @@ interface AIProviderDetails {
 // the frontier model. The gpt-5 family is deprecated (retires 2026-12-11) but
 // still served, so it stays in the list below the 5.6 models.
 const OPENAI_MODELS = [
+	'gpt-6.1-sol',
 	'gpt-6-sol',
 	'gpt-6-astra',
 	'gpt-6-luna',
@@ -1371,6 +1373,7 @@ export async function parseOpenAICompletion(
 		workspace?: string
 		provider?: string
 		onTokenUsage?: (usage: ChatTokenUsage) => void
+		live?: LiveToolSet
 	}
 ): Promise<{ shouldContinue: boolean; tokenUsage: ChatTokenUsage }> {
 	const finalToolCalls: Record<number, ChatCompletionChunk.Choice.Delta.ToolCall> = {}
@@ -1582,7 +1585,8 @@ export async function parseOpenAICompletion(
 				helpers,
 				toolCallbacks: callbacks,
 				workspace: options?.workspace,
-				messages
+				messages,
+				live: options?.live
 			})
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
diff --git a/frontend/src/lib/components/copilot/reasoningParity.json b/frontend/src/lib/components/copilot/reasoningParity.json
index 93b8ac7eb2..1f20def9be 100644
--- a/frontend/src/lib/components/copilot/reasoningParity.json
+++ b/frontend/src/lib/components/copilot/reasoningParity.json
@@ -47,6 +47,12 @@
 		"canDisable": false,
 		"completionsToolsNeedOff": true
 	},
+	{
+		"provider": "openai",
+		"model": "gpt-6.1-sol",
+		"canDisable": false,
+		"completionsToolsNeedOff": true
+	},
 	{
 		"provider": "openai",
 		"model": "gpt-6-sol",
diff --git a/frontend/src/lib/components/copilot/reasoningRegistry.ts b/frontend/src/lib/components/copilot/reasoningRegistry.ts
index 68934c22f3..0cbf935832 100644
--- a/frontend/src/lib/components/copilot/reasoningRegistry.ts
+++ b/frontend/src/lib/components/copilot/reasoningRegistry.ts
@@ -131,9 +131,10 @@ const BEDROCK_RULES: ReasoningRule[] = [
 // Azure names gpt-3.5 `gpt-35-turbo`. `minimal` exists on gpt-5 only, `xhigh` from
 // gpt-5.5, `max` from gpt-5.6.
 const OPENAI_RULES: ReasoningRule[] = [
-	// Live-verified: astra takes low..max only, where sol and luna also take `none`.
+	// Live-verified: gpt-6-astra and gpt-6.1-sol take low..max only, where gpt-6-sol and
+	// gpt-6-luna also take `none`.
 	{
-		match: /(?:^|\/)gpt-6-astra/,
+		match: /(?:^|\/)gpt-6(?:-astra|\.1-sol)/,
 		levels: LOW_TO_MAX,
 		canDisable: false,
 		completionsToolsNeedOff: true
diff --git a/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte b/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte
index a3a765014a..f4b7f1df60 100644
--- a/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte
+++ b/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte
@@ -1,36 +1,48 @@
 <script lang="ts">
 	import { WorkspaceService, type AclChange, type AclTarget, type DatatableAclInfo } from '$lib/gen'
 	import { resource } from 'runed'
-	import { Trash2 } from 'lucide-svelte'
+	import type { Snippet } from 'svelte'
+	import { Tooltip } from '../meltComponents'
+	import { KeyRound, Trash2 } from 'lucide-svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { Alert, Button } from '../common'
 	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
 	import Select from '../select/Select.svelte'
+	import PgGrantBuilder from './PgGrantBuilder.svelte'
 	import DataTable from '../table/DataTable.svelte'
 	import Head from '../table/Head.svelte'
 	import Row from '../table/Row.svelte'
 	import Cell from '../table/Cell.svelte'
-	import PgGrantBuilder from './PgGrantBuilder.svelte'
+	import Badge from '../common/badge/Badge.svelte'
 	import {
 		ADMIN_ROLE,
 		blockingSources,
 		grantKey,
-		grantScopeLabel,
+		grantCoverage,
+		scopesOf,
 		groupGrants,
 		revocablePrivileges,
 		revokeScopeOf,
-		uncoveredCreators
+		uncoveredCreators,
+		type AclScope,
+		type GroupedGrant
 	} from './aclScopes'
 
 	let {
 		workspace,
 		datatable,
-		target
+		target,
+		disabledReason,
+		manageRoles
 	}: {
 		workspace: string
 		datatable: string
 		/** What owner and grants are read and written for. */
 		target: AclTarget
+		/** Shows owner and grants without letting them change, with this reason on hover. */
+		disabledReason?: string
+		/** Offered at the bottom of every role picker. `blocker` keeps the entry, disabled, with why. */
+		manageRoles?: { open: () => void; blocker?: string }
 	} = $props()
 
 	const acl = resource(
@@ -45,6 +57,11 @@
 			})
 	)
 
+	/** Re-read owner, grants and the roles they can name, e.g. after the data table's roles changed. */
+	export function refresh() {
+		acl.refetch()
+	}
+
 	// Nothing is written before its SQL has been shown, and the apply runs exactly that SQL: the
 	// server plans again and refuses if the result differs.
 	let pending = $state<
@@ -54,7 +71,32 @@
 	let applying = $state(false)
 
 	const info: DatatableAclInfo | undefined = $derived(acl.current)
+	const controlsDisabled = $derived(planning || applying || !!disabledReason)
 	const grantRows = $derived(groupGrants(info?.grants ?? []))
+	// Several tags of one kind widen the list; tags of both kinds narrow it to grants matching each.
+	let roleFilters = $state<string[]>([])
+	let privilegeFilters = $state<string[]>([])
+	// A selected tag stays offered after its last grant goes, so it can still be cleared.
+	const roleChips = $derived(
+		[...new Set([...grantRows.map((g) => g.grantee), ...roleFilters])].sort()
+	)
+	const privilegeChips = $derived(
+		[...new Set([...grantRows.flatMap((g) => g.privileges), ...privilegeFilters])].sort()
+	)
+	const shownGrantRows = $derived(
+		grantRows.filter(
+			(g) =>
+				(roleFilters.length === 0 || roleFilters.includes(g.grantee)) &&
+				(privilegeFilters.length === 0 || g.privileges.some((p) => privilegeFilters.includes(p)))
+		)
+	)
+	/** What a grant on the object itself reads as, in the scope picker's words. */
+	const targetLabel = $derived(scopesOf(target.kind)[0].label)
+	// Most grants are on the object itself, which the column would only repeat.
+	const showCoverage = $derived(grantRows.some((g) => grantCoverage(g, target) !== undefined))
+	const columns = $derived(showCoverage ? 4 : 3)
+	const toggled = (list: string[], value: string) =>
+		list.includes(value) ? list.filter((v) => v !== value) : [...list, value]
 	const ownerItems = $derived(
 		info
 			? (info.roles.includes(info.owner) ? info.roles : [info.owner, ...info.roles]).map((r) => ({
@@ -68,6 +110,28 @@
 		pending?.change.type === 'revoke' && (pending.change.objects?.length ?? 0) > 1
 	)
 
+	/** Why a row's delete button is disabled, or undefined when it can revoke. */
+	function unrevocableReason(
+		grant: GroupedGrant,
+		revokeScope: AclScope | undefined,
+		revocable: string[],
+		blocked: string[]
+	): string | undefined {
+		// What `admin` holds is what every role here connects through.
+		if (grant.grantee === ADMIN_ROLE)
+			return 'admin is the connection every role reaches this data table through, so its grants are not changed here'
+		if (!info?.roles.includes(grant.grantee))
+			return `Only grants to this data table's roles are revoked here, and ${grant.grantee} is not one`
+		if (!revokeScope) return 'Grants on types are read only here'
+		if (revocable.length === 0)
+			return grant.future
+				? 'Default privileges set database-wide are not revoked from here'
+				: "CONNECT follows the data table's roles and TEMPORARY is left as Postgres sets it, so nothing here can be revoked"
+		if (blocked.length > 0)
+			return `Only ${blocked.join(', ')} can revoke this: Postgres takes a grant back through the role that made it`
+		return undefined
+	}
+
 	function errorText(e: any): string {
 		return e?.body ?? e?.message ?? String(e)
 	}
@@ -108,6 +172,60 @@
 	}
 </script>
 
+<!-- A disabled control receives no hover, so the tooltip's trigger is a wrapper the hover falls
+     through to. -->
+{#snippet withDisabledReason(content: Snippet, widthClass: string)}
+	{#if disabledReason}
+		<Tooltip class="block {widthClass}" anchor="cursor">
+			<div class="pointer-events-none">{@render content()}</div>
+			{#snippet text()}{disabledReason}{/snippet}
+		</Tooltip>
+	{:else}
+		{@render content()}
+	{/if}
+{/snippet}
+
+<!-- The home page's filter chips, any number of them selected at once. -->
+{#snippet filterChip(label: string, selected: boolean, toggle: () => void)}
+	<Badge color="transparent" clickable {selected} onclick={toggle}>
+		{label}
+		{#if selected}&cross;{/if}
+	</Badge>
+{/snippet}
+
+<!-- Styled like the picker's tags in the row that creates a grant. -->
+{#snippet tag(text: string)}
+	<span class="inline-flex items-center min-h-6 px-2 border bg-surface rounded-full text-emphasis">
+		{text}
+	</span>
+{/snippet}
+
+{#snippet manageRolesEntry({ close }: { close: () => void })}
+	<div class="flex items-center gap-1 border-t p-1">
+		<Button
+			unifiedSize="sm"
+			variant="subtle"
+			startIcon={{ icon: KeyRound }}
+			disabled={!!manageRoles?.blocker}
+			btnClasses="w-full justify-start"
+			wrapperClasses="grow"
+			onClick={() => {
+				close()
+				manageRoles?.open()
+			}}
+		>
+			Manage roles
+		</Button>
+		{#if manageRoles?.blocker}
+			<span class="pr-2 flex">
+				<Tooltip>
+					{#snippet text()}{manageRoles?.blocker}{/snippet}
+				</Tooltip>
+			</span>
+		{/if}
+	</div>
+{/snippet}
+
 {#if acl.error}
 	<Alert type="error" title="Could not read access" size="xs">{errorText(acl.error)}</Alert>
 {:else if !info}
@@ -137,22 +255,26 @@
 					</span>
 				</div>
 				{#if info.editable}
-					<Select
-						items={ownerItems}
-						disabled={planning || applying}
-						size="sm"
-						class="w-64"
-						bind:value={
-							() => info.owner,
-							(role) => {
-								// The select shows what the database says; a pick is a request, and only the
-								// applied change moves it.
-								if (role && role !== info.owner) {
-									confirm({ type: 'set_owner', role }, `Ownership transferred to ${role}`)
+					{#snippet ownerSelect()}
+						<Select
+							items={ownerItems}
+							disabled={controlsDisabled}
+							size="sm"
+							class="w-64"
+							bind:value={
+								() => info.owner,
+								(role) => {
+									// The select shows what the database says; a pick is a request, and only the
+									// applied change moves it.
+									if (role && role !== info.owner) {
+										confirm({ type: 'set_owner', role }, `Ownership transferred to ${role}`)
+									}
 								}
 							}
-						}
-					/>
+							bottomSnippet={manageRoles ? manageRolesEntry : undefined}
+						/>
+					{/snippet}
+					{@render withDisabledReason(ownerSelect, 'w-64')}
 				{:else}
 					<span class="font-mono text-xs">{info.owner}</span>
 				{/if}
@@ -168,75 +290,76 @@
 						: 'What each role may do here, beyond what it owns.'}
 				</span>
 			</div>
-			{#if info.editable}
-				<PgGrantBuilder
-					{target}
-					roles={info.roles}
-					disabled={planning || applying}
-					supportsMaintain={info.supports_maintain}
-					dbname={info.dbname}
-					onAdd={({ role, privileges, scope }) =>
-						confirm(
-							{ type: 'grant', role, privileges, scope },
-							`Granted ${privileges.join(', ')} to ${role}`
-						)}
-				/>
+			<!-- A set filter keeps its chips, or a revoke that leaves one grant would strand it. -->
+			{#if grantRows.length > 1 || roleFilters.length > 0 || privilegeFilters.length > 0}
+				<div class="flex flex-wrap items-center gap-2">
+					{#each roleChips as role (`role:${role}`)}
+						{@render filterChip(role, roleFilters.includes(role), () => {
+							roleFilters = toggled(roleFilters, role)
+						})}
+					{/each}
+					{#each privilegeChips as privilege (`privilege:${privilege}`)}
+						{@render filterChip(privilege, privilegeFilters.includes(privilege), () => {
+							privilegeFilters = toggled(privilegeFilters, privilege)
+						})}
+					{/each}
+				</div>
 			{/if}
-			{#if grantRows.length === 0}
-				<span class="text-xs text-secondary">No grants yet.</span>
-			{:else}
-				<DataTable size="xs">
-					<Head>
-						<tr>
-							<Cell head first>Role</Cell>
-							<Cell head>Privileges</Cell>
+			<DataTable size="xs">
+				<Head>
+					<tr>
+						<Cell head first>Role</Cell>
+						<Cell head>Privileges</Cell>
+						{#if showCoverage}
 							<Cell head>On</Cell>
-							<Cell head last></Cell>
-						</tr>
-					</Head>
-					<tbody class="divide-y">
-						{#each grantRows as grant (grantKey(grant))}
-							{@const revokeScope = revokeScopeOf(grant)}
-							{@const revocable = revocablePrivileges(grant, target)}
-							{@const blocked = blockingSources(grant, revocable)}
-							{@const uncovered = uncoveredCreators(grant, info.roles)}
-							<Row>
-								<Cell first>{grant.grantee}</Cell>
-								<Cell wrap
-									><span class="font-mono text-2xs">{grant.privileges.join(', ')}</span></Cell
-								>
-								<Cell wrap>
-									{grantScopeLabel(grant)}
-									{#if blocked.length > 0}
-										<span
-											class="text-2xs text-secondary"
-											title="Only this role can take the grant back: Postgres revokes a grant through the role that made it"
-										>
-											from {blocked.join(', ')}
-										</span>
-									{/if}
-									{#if uncovered.length > 0}
-										<span
-											class="text-2xs text-secondary"
-											title="A default privilege covers only the roles it was granted for: grant it again to cover these"
-										>
-											· not for what {uncovered.join(', ')}
-											{uncovered.length === 1 ? 'creates' : 'create'}
-										</span>
-									{/if}
+						{/if}
+						<Cell head last />
+					</tr>
+				</Head>
+				<tbody class="divide-y">
+					{#each shownGrantRows as grant (grantKey(grant))}
+						{@const revokeScope = revokeScopeOf(grant)}
+						{@const revocable = revocablePrivileges(grant, target)}
+						{@const blocked = blockingSources(grant, revocable)}
+						{@const uncovered = uncoveredCreators(grant, info.roles)}
+						{@const unrevocable = unrevocableReason(grant, revokeScope, revocable, blocked)}
+						<Row>
+							<Cell first class="font-medium text-emphasis">{grant.grantee}</Cell>
+							<Cell wrap>
+								<div class="flex flex-wrap items-center gap-1">
+									{#each grant.privileges as privilege (privilege)}
+										{@render tag(privilege)}
+									{/each}
+								</div>
+								{#if blocked.length > 0 || uncovered.length > 0}
+									<div class="mt-0.5 text-2xs text-secondary">
+										{[
+											blocked.length > 0 && `granted by ${blocked.join(', ')}`,
+											uncovered.length > 0 &&
+												`not for what ${uncovered.join(', ')} ${uncovered.length === 1 ? 'creates' : 'create'}: a default privilege only covers the roles it was granted for`
+										]
+											.filter(Boolean)
+											.join(' · ')}
+									</div>
+								{/if}
+							</Cell>
+							{#if showCoverage}
+								<Cell wrap class="text-secondary">
+									{grantCoverage(grant, target) ?? targetLabel}
 								</Cell>
-								<Cell last>
-									<!-- What `admin` holds is what every role here connects through, so it is not
-									this editor's to take away. -->
-									{#if info.editable && revokeScope && revocable.length > 0 && blocked.length === 0 && info.roles.includes(grant.grantee) && grant.grantee !== ADMIN_ROLE}
+							{/if}
+							<Cell last class="w-10">
+								{#if info.editable}
+									{#snippet revokeButton()}
 										<Button
 											unifiedSize="xs"
 											variant="subtle"
 											iconOnly
 											startIcon={{ icon: Trash2 }}
-											title="Revoke {revocable.join(', ')}"
-											disabled={planning || applying}
-											onClick={() =>
+											title={unrevocable ?? `Revoke ${revocable.join(', ')}`}
+											disabled={controlsDisabled || !!unrevocable}
+											onClick={() => {
+												if (!revokeScope) return
 												confirm(
 													{
 														type: 'revoke',
@@ -246,15 +369,52 @@
 														objects: grant.objects
 													},
 													`Revoked ${revocable.join(', ')} from ${grant.grantee}`
-												)}
+												)
+											}}
 										/>
+									{/snippet}
+									{#if unrevocable && !disabledReason}
+										<Tooltip>
+											<div class="pointer-events-none">{@render revokeButton()}</div>
+											{#snippet text()}{unrevocable}{/snippet}
+										</Tooltip>
+									{:else}
+										{@render withDisabledReason(revokeButton, 'w-fit')}
 									{/if}
-								</Cell>
-							</Row>
-						{/each}
-					</tbody>
-				</DataTable>
-			{/if}
+								{/if}
+							</Cell>
+						</Row>
+					{:else}
+						<Row>
+							<Cell first last colspan={columns} class="text-secondary">
+								{grantRows.length === 0 ? 'No grants yet.' : 'No grant matches the filters.'}
+							</Cell>
+						</Row>
+					{/each}
+					{#if info.editable}
+						<!-- The grant to create: a row of the table, set apart until it exists. -->
+						<Row class="bg-surface-secondary">
+							<Cell first last colspan={columns}>
+								{#snippet grantBuilder()}
+									<PgGrantBuilder
+										{target}
+										roles={info.roles}
+										disabled={controlsDisabled}
+										manageRoles={manageRoles ? manageRolesEntry : undefined}
+										supportsMaintain={info.supports_maintain}
+										onAdd={({ role, privileges, scope }) =>
+											confirm(
+												{ type: 'grant', role, privileges, scope },
+												`Granted ${privileges.join(', ')} to ${role}`
+											)}
+									/>
+								{/snippet}
+								{@render withDisabledReason(grantBuilder, 'w-full')}
+							</Cell>
+						</Row>
+					{/if}
+				</tbody>
+			</DataTable>
 		</section>
 	</div>
 {/if}
diff --git a/frontend/src/lib/components/datatableAcl/PgGrantBuilder.svelte b/frontend/src/lib/components/datatableAcl/PgGrantBuilder.svelte
index 5e5119abb6..745c1a1db5 100644
--- a/frontend/src/lib/components/datatableAcl/PgGrantBuilder.svelte
+++ b/frontend/src/lib/components/datatableAcl/PgGrantBuilder.svelte
@@ -1,17 +1,18 @@
 <script lang="ts">
 	import type { AclTarget } from '$lib/gen'
+	import type { Snippet } from 'svelte'
 	import { Plus } from 'lucide-svelte'
 	import { Button } from '../common'
 	import Select from '../select/Select.svelte'
 	import MultiSelect from '../select/MultiSelect.svelte'
-	import { privilegesOf, scopeSql, scopesOf, type AclScope } from './aclScopes'
+	import { privilegesOf, scopesOf, type AclScope } from './aclScopes'
 
 	let {
 		target,
 		roles,
 		supportsMaintain = false,
-		dbname,
 		disabled = false,
+		manageRoles,
 		onAdd
 	}: {
 		target: AclTarget
@@ -19,9 +20,9 @@
 		roles: string[]
 		/** Postgres 17+, which has one more table privilege to offer. */
 		supportsMaintain?: boolean
-		/** Names the database in the statement a database target builds. */
-		dbname?: string
 		disabled?: boolean
+		/** Rendered at the bottom of the role picker, to reach the data table's roles. */
+		manageRoles?: Snippet<[{ close: () => void }]>
 		onAdd: (grant: { role: string; privileges: string[]; scope: AclScope }) => void
 	} = $props()
 
@@ -29,26 +30,24 @@
 	let scope = $state<AclScope>('target')
 	let privileges = $state<string[]>([])
 
+	const scopes = $derived(scopesOf(target.kind))
 	const available = $derived(privilegesOf(scope, target.kind, supportsMaintain))
-	const statement = $derived(
-		privileges.length && role
-			? `GRANT ${privileges.join(', ')} ON ${scopeSql(scope, target, dbname)} TO ${role}`
-			: undefined
-	)
 </script>
 
-<div class="flex flex-col gap-2 border rounded-md p-3">
-	<div class="flex flex-wrap items-center gap-2 text-xs text-secondary">
-		<span class="font-mono text-primary">GRANT</span>
-		<MultiSelect
-			bind:value={privileges}
-			items={available.map((p) => ({ value: p, label: p }))}
-			placeholder="privileges"
-			{disabled}
-			size="sm"
-			class="min-w-48"
-		/>
-		<span class="font-mono text-primary">ON</span>
+<!-- Laid out like the grants above it, so it reads as the statement it will run. -->
+<div class="flex items-center gap-2 text-xs text-secondary">
+	<span class="font-mono shrink-0">GRANT</span>
+	<MultiSelect
+		bind:value={privileges}
+		items={available.map((p) => ({ value: p, label: p }))}
+		placeholder="privileges"
+		{disabled}
+		size="md"
+		class="min-w-0 flex-[4]"
+	/>
+	<!-- A database or a table has only itself to grant on. -->
+	{#if scopes.length > 1}
+		<span class="font-mono shrink-0">ON</span>
 		<Select
 			bind:value={
 				() => scope,
@@ -61,35 +60,34 @@
 					privileges = privileges.filter((p) => allowed.includes(p))
 				}
 			}
-			items={scopesOf(target.kind)}
+			items={scopes}
 			{disabled}
-			size="sm"
-			class="w-52"
+			size="md"
+			class="min-w-0 flex-[3]"
 		/>
-		<span class="font-mono text-primary">TO</span>
-		<Select
-			bind:value={role}
-			items={roles.map((r) => ({ value: r, label: r }))}
-			placeholder="role"
-			{disabled}
-			size="sm"
-			class="w-40"
-		/>
-		<Button
-			unifiedSize="sm"
-			variant="default"
-			startIcon={{ icon: Plus }}
-			disabled={disabled || !role || privileges.length === 0}
-			onClick={() => {
-				if (!role) return
-				onAdd({ role, privileges: [...privileges], scope })
-				privileges = []
-			}}
-		>
-			Add
-		</Button>
-	</div>
-	{#if statement}
-		<pre class="text-2xs text-tertiary overflow-x-auto">{statement}</pre>
 	{/if}
+	<span class="font-mono shrink-0">TO</span>
+	<Select
+		bind:value={role}
+		items={roles.map((r) => ({ value: r, label: r }))}
+		placeholder="role"
+		{disabled}
+		size="md"
+		class="min-w-0 flex-[2]"
+		bottomSnippet={manageRoles}
+	/>
+	<Button
+		unifiedSize="md"
+		variant="default"
+		wrapperClasses="shrink-0"
+		startIcon={{ icon: Plus }}
+		disabled={disabled || !role || privileges.length === 0}
+		onClick={() => {
+			if (!role) return
+			onAdd({ role, privileges: [...privileges], scope })
+			privileges = []
+		}}
+	>
+		Create
+	</Button>
 </div>
diff --git a/frontend/src/lib/components/datatableAcl/aclScopes.test.ts b/frontend/src/lib/components/datatableAcl/aclScopes.test.ts
index 7c01836e89..aa385ea5af 100644
--- a/frontend/src/lib/components/datatableAcl/aclScopes.test.ts
+++ b/frontend/src/lib/components/datatableAcl/aclScopes.test.ts
@@ -3,10 +3,12 @@ import type { AclGrant } from '$lib/gen'
 import {
 	blockingSources,
 	grantKey,
+	grantCoverage,
 	groupGrants,
 	revocablePrivileges,
 	revokeScopeOf,
-	uncoveredCreators
+	uncoveredCreators,
+	type GroupedGrant
 } from './aclScopes'
 
 const table = (name: string) => ({ name, kind: 'TABLE' })
@@ -176,3 +178,29 @@ describe('uncoveredCreators', () => {
 		).toEqual([])
 	})
 })
+
+describe('grantCoverage', () => {
+	const schema = { kind: 'schema' as const, schema: 'sales' }
+	const row = (grant: Partial<GroupedGrant>): GroupedGrant => ({
+		grantee: 'analytics',
+		privileges: ['SELECT'],
+		objects: [],
+		sources: [],
+		...grant
+	})
+
+	it('says nothing for the object itself, and names what is created later', () => {
+		expect(grantCoverage(row({}), schema)).toBeUndefined()
+		expect(grantCoverage(row({ future: 'TABLES' }), schema)).toBe('tables created later')
+		expect(grantCoverage(row({ future: 'TABLES' }), { kind: 'database' })).toBe(
+			'tables created later, in every schema'
+		)
+	})
+
+	it('names a routine with its arguments, and summarizes past three objects', () => {
+		const routine = row({ objects: [{ name: 'refresh', kind: 'FUNCTION', args: 'integer' }] })
+		expect(grantCoverage(routine, schema)).toBe('function refresh(integer)')
+		const many = row({ objects: ['a', 'b', 'c', 'd', 'e'].map(table) })
+		expect(grantCoverage(many, schema)).toBe('tables a, b, c and 2 more')
+	})
+})
diff --git a/frontend/src/lib/components/datatableAcl/aclScopes.ts b/frontend/src/lib/components/datatableAcl/aclScopes.ts
index d5b8ad9d20..4127920c1d 100644
--- a/frontend/src/lib/components/datatableAcl/aclScopes.ts
+++ b/frontend/src/lib/components/datatableAcl/aclScopes.ts
@@ -73,28 +73,6 @@ export function privilegesOf(
 	}
 }
 
-/** What a statement built at this scope reads as, for the builder's own preview. */
-export function scopeSql(scope: AclScope, target: AclTarget, dbname?: string): string {
-	if (target.kind === 'database') return `DATABASE ${dbname ?? ''}`.trim()
-	const schema = target.schema
-	switch (scope) {
-		case 'target':
-			return target.kind === 'schema' ? `SCHEMA ${schema}` : `TABLE ${schema}.${target.table}`
-		case 'all_tables':
-			return `ALL TABLES IN SCHEMA ${schema}`
-		case 'all_sequences':
-			return `ALL SEQUENCES IN SCHEMA ${schema}`
-		case 'all_functions':
-			return `ALL FUNCTIONS IN SCHEMA ${schema}`
-		case 'future_tables':
-			return `TABLES (default privileges in ${schema})`
-		case 'future_sequences':
-			return `SEQUENCES (default privileges in ${schema})`
-		case 'future_functions':
-			return `FUNCTIONS (default privileges in ${schema})`
-	}
-}
-
 /** One row of the grants table: the same privileges on several objects read as one line, since
  * granting them per object is what `ON ALL TABLES` does. */
 export type GroupedGrant = {
@@ -195,17 +173,21 @@ export function revocablePrivileges(grant: GroupedGrant, target: AclTarget): str
 	return grant.privileges
 }
 
-/** How a row reads back: what it covers, in one phrase. */
-export function grantScopeLabel(grant: GroupedGrant): string {
-	if (grant.future) return `${grant.future.toLowerCase()} created later`
-	if (grant.objects.length === 1) {
-		const object = grant.objects[0]
-		// A routine's arguments are part of what it is, so two of the same name would otherwise
-		// read as one row twice.
-		const args = object.args !== undefined ? `(${object.args})` : ''
-		return `${object.kind.toLowerCase()} ${object.name}${args}`
+/** How many objects a folded row names before it summarizes the rest. */
+const LISTED_OBJECTS = 3
+
+/** What a row covers, when that is not the editor's own object: the objects inside it, or what is
+ * created later. Undefined for a grant on the object itself, which needs no saying. */
+export function grantCoverage(grant: GroupedGrant, target: AclTarget): string | undefined {
+	if (grant.future) {
+		const created = `${grant.future.toLowerCase()} created later`
+		return target.kind === 'database' ? `${created}, in every schema` : created
 	}
-	if (grant.objects.length > 1)
-		return `${grant.objects.length} ${grant.objects[0].kind.toLowerCase()}s`
-	return 'itself'
+	if (grant.objects.length === 0) return undefined
+	// A routine's arguments are part of what it is: two of the same name are different objects.
+	const names = grant.objects.map((o) => (o.args !== undefined ? `${o.name}(${o.args})` : o.name))
+	const listed = names.slice(0, LISTED_OBJECTS).join(', ')
+	const rest = names.length - LISTED_OBJECTS
+	const kind = grant.objects[0].kind.toLowerCase()
+	return `${names.length > 1 ? `${kind}s` : kind} ${listed}${rest > 0 ? ` and ${rest} more` : ''}`
 }
diff --git a/frontend/src/lib/components/details/DetailPageHeader.svelte b/frontend/src/lib/components/details/DetailPageHeader.svelte
index 72c39ba512..34a7fab355 100644
--- a/frontend/src/lib/components/details/DetailPageHeader.svelte
+++ b/frontend/src/lib/components/details/DetailPageHeader.svelte
@@ -3,10 +3,10 @@
 
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import ErrorHandlerToggleButton from './ErrorHandlerToggleButton.svelte'
-	import { twMerge } from 'tailwind-merge'
-	import { userStore } from '$lib/stores'
-	import { createEventDispatcher, getContext, tick } from 'svelte'
+	import { createEventDispatcher, getContext, tick, type Snippet } from 'svelte'
 	import SummaryPathDisplay from '$lib/components/SummaryPathDisplay.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
 	import type { TriggerContext } from '../triggers'
 	import type { Item } from '$lib/utils'
 	import { Bell, BellOff, Calendar } from 'lucide-svelte'
@@ -37,9 +37,10 @@
 	}
 
 	// An agent's page has no triggers, and so no context for them.
-	const { triggersCount, triggersState } = $state(
-		getContext<TriggerContext | undefined>('TriggerContext') ?? ({} as Partial<TriggerContext>)
-	)
+	const triggerContext = getContext<TriggerContext | undefined>('TriggerContext')
+	const { triggersCount, triggersState } = $state(triggerContext ?? ({} as Partial<TriggerContext>))
+	// The buttons below render in the page header, away from this page's tree.
+	const headerContexts = new Map<any, any>([['TriggerContext', triggerContext]])
 
 	interface Props {
 		mainButtons?: MainButton[]
@@ -49,6 +50,9 @@
 		tag?: string | undefined
 		/** Unset for what has no workspace error handler to mute, such as an agent. */
 		errorHandlerKind?: 'flow' | 'script'
+		/** What the rename popover is renaming, when that is not the error handler's kind — an
+		 *  agent has no error handler but is still renamed from here. */
+		itemKind?: 'flow' | 'script' | 'agent'
 		scriptOrFlowPath?: string
 		errorHandlerMuted?: boolean | undefined
 		labels?: string[] | undefined
@@ -56,6 +60,10 @@
 		onSaved?: (newPath: string) => void
 		children?: import('svelte').Snippet
 		trigger_badges?: import('svelte').Snippet
+		/** True for the route's own page: its header becomes the page header. A host that renders
+		 *  this inside something else — a session's preview panel — leaves it false and gets the
+		 *  row below. */
+		ownsPageHeader?: boolean
 		/** Whether the bar is wide enough to hold every button beside the summary, decided by
 		 * the layout from its own width. Not a viewport media query: the same page also renders
 		 * inside an AI session's preview panel, where the window is wide and the pane is not. */
@@ -71,6 +79,7 @@
 		path,
 		tag,
 		errorHandlerKind,
+		itemKind,
 		scriptOrFlowPath,
 		errorHandlerMuted = $bindable(),
 		labels = $bindable(),
@@ -78,13 +87,30 @@
 		onSaved,
 		children,
 		trigger_badges,
+		ownsPageHeader = false,
 		wide = true,
 		leading_actions
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
 
-	const barButtons = $derived(wide ? mainButtons : mainButtons.filter((b) => !b.narrow))
+	// A flow and a script are renamed as what their error handler already names them; an agent has
+	// no error handler and says so itself.
+	const renameKind = $derived(itemKind ?? errorHandlerKind)
+
+	// Two reasons the row can be too tight, and either one collapses it. The host knows when its
+	// own box is narrow while the window is not — a session's preview panel — and says so through
+	// `wide`. The band knows its own width, which the host cannot see: these buttons share that row
+	// with the breadcrumb, and the trail and summary want ~580px against the set's ~530. Unmeasured
+	// (0) counts as wide, because the bar measures itself on mount and starting narrow would pop
+	// the buttons out of the menu a frame later.
+	// Measured on a flow's page: a 1192px bar leaves the last button 4px past the edge, so the row
+	// has to fold before that rather than at the ~1150 the two parts add up to on paper.
+	const COLLAPSE_BELOW = 1250
+	const roomInBar = $derived(pageHeader.barWidth === 0 || pageHeader.barWidth >= COLLAPSE_BELOW)
+	const wideRow = $derived(wide && roomInBar)
+
+	const barButtons = $derived(wideRow ? mainButtons : mainButtons.filter((b) => !b.narrow))
 
 	function dropdownHost(btn: MainButton): MainButton | undefined {
 		if (typeof btn.narrow !== 'object') return undefined
@@ -104,7 +130,7 @@
 	}
 
 	const allMenuItems: Item[] = $derived([
-		...(wide ? [] : mainButtons.filter((b) => b.narrow && !dropdownHost(b))).map((b) => ({
+		...(wideRow ? [] : mainButtons.filter((b) => b.narrow && !dropdownHost(b))).map((b) => ({
 			displayName: b.label,
 			description: b.description,
 			icon: b.buttonProps.startIcon,
@@ -113,7 +139,7 @@
 			disabled: b.buttonProps.disabled,
 			type: 'action' as const
 		})),
-		...(wide || !errorHandlerKind
+		...(wideRow || !errorHandlerKind
 			? []
 			: [
 					{
@@ -129,12 +155,12 @@
 			action: item.onclick,
 			disabled: item.disabled,
 			type: item.color === 'red' ? ('delete' as const) : ('action' as const),
-			separatorTop: i === 0 && !wide
+			separatorTop: i === 0 && !wideRow
 		}))
 	])
 
 	function dropdownItemsOf(host: MainButton) {
-		if (wide) return undefined
+		if (wideRow) return undefined
 		const items = mainButtons
 			.filter((b) => dropdownHost(b) === host)
 			.map((b) => ({
@@ -149,74 +175,138 @@
 	}
 </script>
 
-<div class="border-b">
-	<div class="mx-auto">
-		<div
-			class="flex w-full flex-wrap md:flex-nowrap justify-end gap-x-2 gap-y-4 items-center min-h-12 py-2 md:py-0"
+{#snippet summaryContent()}
+	<SummaryPathDisplay
+		{summary}
+		{path}
+		bind:labels
+		{inheritedLabels}
+		{onSaved}
+		kind={renameKind}
+		compact
+	/>
+{/snippet}
+
+<!-- The same editor as the summary's, hung off the band's path segment so it opens under the path.
+     with the cursor in the path field. `bind:` cannot be spread, so `labels` is bound twice; both
+     instances bind the same slot and only one is ever open. -->
+{#snippet pathTrigger(pathLabel: Snippet, triggerClass: string)}
+	<SummaryPathDisplay
+		label={pathLabel}
+		{triggerClass}
+		focusField="path"
+		{summary}
+		{path}
+		bind:labels
+		{inheritedLabels}
+		{onSaved}
+		kind={renameKind}
+	/>
+{/snippet}
+
+<!-- The two halves of the row, rendered side by side in the band and in the two groups of the
+     row below. One copy each: a button added to one placement belongs in both. -->
+{#snippet badges(size: 'sm' | 'md')}
+	{#if tag}
+		<Badge>tag: {tag}</Badge>
+	{/if}
+	{@render children?.()}
+	{#if triggersState?.triggers?.some((t) => t.isPrimary && !t.isDraft)}
+		{@const primarySchedule = triggersState.triggers.findIndex((t) => t.isPrimary && !t.isDraft)}
+		<Button
+			btnClasses="inline-flex"
+			startIcon={{ icon: Calendar }}
+			variant="default"
+			unifiedSize={size}
+			on:click={async () => {
+				dispatch('seeTriggers')
+				await tick()
+				triggersState.selectedTriggerIndex = primarySchedule
+			}}
 		>
-			<div class="grow px-2 inline-flex items-center gap-4 min-w-0">
-				<div class={twMerge('min-w-0', $userStore?.operator ? 'pl-10' : '')}>
-					<SummaryPathDisplay
-						{summary}
-						{path}
-						bind:labels
-						{inheritedLabels}
-						{onSaved}
-						kind={errorHandlerKind}
-					/>
+			{$triggersCount?.primary_schedule?.schedule ?? ''}
+		</Button>
+	{/if}
+	{@render trigger_badges?.()}
+{/snippet}
+
+{#snippet controls(size: 'sm' | 'md')}
+	{@render leading_actions?.()}
+	{#if allMenuItems.length > 0}
+		{#key allMenuItems}
+			<DropdownV2 items={allMenuItems} placement="bottom-end" {size} />
+		{/key}
+	{/if}
+	{#if wideRow && errorHandlerKind && scriptOrFlowPath}
+		<ErrorHandlerToggleButton
+			kind={errorHandlerKind}
+			{scriptOrFlowPath}
+			bind:errorHandlerMuted
+			unifiedSize={size}
+		/>
+	{/if}
+	{#each barButtons as btn (btn.label)}
+		{@const dropdownItems = dropdownItemsOf(btn)}
+		<Button
+			{...btn.buttonProps}
+			startIcon={{ icon: btn.buttonProps.startIcon }}
+			unifiedSize={size}
+			{dropdownItems}
+			dropdownWidth={dropdownItems?.some((i) => i.description) ? 288 : undefined}
+			btnClasses="flex items-center gap-1 whitespace-nowrap"
+		>
+			{btn.label}
+		</Button>
+	{/each}
+{/snippet}
+
+{#snippet actions()}
+	{@render badges('sm')}
+	{@render controls('sm')}
+{/snippet}
+
+{#if ownsPageHeader}
+	<!-- The summary keeps its rename-and-labels popover here rather than becoming plain text in
+	     the breadcrumb: renaming a script or flow is done from this page, not from the trail. -->
+	<PageHeaderContent
+		item={{
+			kind: errorHandlerKind,
+			path,
+			summaryContent,
+			// Only where this page can save one: without `onSaved` the editor behind it has nothing
+			// to write, and the band keeps its own segment, which copies the path.
+			pathTrigger: onSaved ? pathTrigger : undefined
+		}}
+		{actions}
+		contexts={headerContexts}
+		separator="always"
+	/>
+{:else}
+	<!-- Nested in a session's preview panel, which has a band of its own above it naming the
+	     session. A page in there draws its own row instead: registering would rename the band to
+	     whatever the panel happens to be showing. -->
+	<div class="border-b">
+		<div class="mx-auto">
+			<div
+				class="flex w-full flex-wrap md:flex-nowrap justify-end gap-x-2 gap-y-4 items-center min-h-12 py-2 md:py-0"
+			>
+				<div class="grow px-2 inline-flex items-center gap-4 min-w-0">
+					<div class="min-w-0">
+						<SummaryPathDisplay
+							{summary}
+							{path}
+							bind:labels
+							{inheritedLabels}
+							{onSaved}
+							kind={renameKind}
+						/>
+					</div>
+					{@render badges('md')}
+				</div>
+				<div class="flex gap-1 items-center pr-4">
+					{@render controls('md')}
 				</div>
-				{#if tag}
-					<Badge>tag: {tag}</Badge>
-				{/if}
-				{@render children?.()}
-				{#if triggersState?.triggers?.some((t) => t.isPrimary && !t.isDraft)}
-					{@const primarySchedule = triggersState.triggers.findIndex(
-						(t) => t.isPrimary && !t.isDraft
-					)}
-					<Button
-						btnClasses="inline-flex"
-						startIcon={{ icon: Calendar }}
-						variant="contained"
-						color="light"
-						size="xs"
-						on:click={async () => {
-							dispatch('seeTriggers')
-							await tick()
-							triggersState.selectedTriggerIndex = primarySchedule
-						}}
-					>
-						{$triggersCount?.primary_schedule?.schedule ?? ''}
-					</Button>
-				{/if}
-				{@render trigger_badges?.()}
-			</div>
-			<div class="flex gap-1 items-center pr-4">
-				{@render leading_actions?.()}
-				{#if allMenuItems.length > 0}
-					{#key allMenuItems}
-						<DropdownV2 items={allMenuItems} placement="bottom-end" size="md" />
-					{/key}
-				{/if}
-				{#if wide && errorHandlerKind && scriptOrFlowPath}
-					<ErrorHandlerToggleButton
-						kind={errorHandlerKind}
-						{scriptOrFlowPath}
-						bind:errorHandlerMuted
-					/>
-				{/if}
-				{#each barButtons as btn (btn.label)}
-					{@const dropdownItems = dropdownItemsOf(btn)}
-					<Button
-						{...btn.buttonProps}
-						startIcon={{ icon: btn.buttonProps.startIcon }}
-						{dropdownItems}
-						dropdownWidth={dropdownItems?.some((i) => i.description) ? 288 : undefined}
-						btnClasses="flex items-center gap-1 whitespace-nowrap"
-					>
-						{btn.label}
-					</Button>
-				{/each}
 			</div>
 		</div>
 	</div>
-</div>
+{/if}
diff --git a/frontend/src/lib/components/details/ErrorHandlerToggleButton.svelte b/frontend/src/lib/components/details/ErrorHandlerToggleButton.svelte
index 49622c8af2..48e833e2ff 100644
--- a/frontend/src/lib/components/details/ErrorHandlerToggleButton.svelte
+++ b/frontend/src/lib/components/details/ErrorHandlerToggleButton.svelte
@@ -13,9 +13,16 @@
 		scriptOrFlowPath: string
 		errorHandlerMuted: boolean | undefined
 		iconOnly?: boolean
+		unifiedSize?: 'xs' | 'sm' | 'md' | 'lg'
 	}
 
-	let { kind, scriptOrFlowPath, errorHandlerMuted = $bindable(), iconOnly = true }: Props = $props()
+	let {
+		kind,
+		scriptOrFlowPath,
+		errorHandlerMuted = $bindable(),
+		iconOnly = true,
+		unifiedSize = 'md'
+	}: Props = $props()
 
 	async function toggleErrorHandler(): Promise<void> {
 		const next = await toggleWorkspaceErrorHandler(
@@ -32,7 +39,7 @@
 	title={errorHandlerMuted === undefined || !errorHandlerMuted
 		? 'Disable workspace error handler for this script'
 		: 'Enable workspace error handler for this script'}
-	unifiedSize="md"
+	{unifiedSize}
 	on:click={toggleErrorHandler}
 	variant="subtle"
 	startIcon={{
diff --git a/frontend/src/lib/components/details/FlowDetail.svelte b/frontend/src/lib/components/details/FlowDetail.svelte
index 0e9f47816b..ce7378ede4 100644
--- a/frontend/src/lib/components/details/FlowDetail.svelte
+++ b/frontend/src/lib/components/details/FlowDetail.svelte
@@ -656,6 +656,7 @@
 	{#snippet header({ wide }: { wide: boolean })}
 		<DetailPageHeader
 			{wide}
+			ownsPageHeader={!embedded}
 			on:seeTriggers={() => {
 				detailLayout?.showTriggers()
 			}}
diff --git a/frontend/src/lib/components/details/ScriptDetail.svelte b/frontend/src/lib/components/details/ScriptDetail.svelte
index 078ab20a47..f33f00fb8f 100644
--- a/frontend/src/lib/components/details/ScriptDetail.svelte
+++ b/frontend/src/lib/components/details/ScriptDetail.svelte
@@ -838,6 +838,7 @@
 		{#snippet header({ wide }: { wide: boolean })}
 			<DetailPageHeader
 				{wide}
+				ownsPageHeader={!embedded}
 				{mainButtons}
 				menuItems={getMenuItems(script, deployUiSettings)}
 				bind:errorHandlerMuted={
diff --git a/frontend/src/lib/components/flow_builder.ts b/frontend/src/lib/components/flow_builder.ts
index f763e92faa..1a4b7e5c26 100644
--- a/frontend/src/lib/components/flow_builder.ts
+++ b/frontend/src/lib/components/flow_builder.ts
@@ -75,4 +75,7 @@ export type FlowBuilderProps = {
 	// EditorHeader's path/breadcrumb row dropped (summary only). Used by the
 	// session preview to save vertical room.
 	condensedHeader?: boolean
+	/** The editor's path/summary and actions go to the route's page header instead of a bar of
+	 *  its own. Only the full-page editor sets it; embedders keep their own bar. */
+	ownsPageHeader?: boolean
 }
diff --git a/frontend/src/lib/components/flows/agentDraft.svelte.ts b/frontend/src/lib/components/flows/agentDraft.svelte.ts
index b76f9bb471..81dcabed2e 100644
--- a/frontend/src/lib/components/flows/agentDraft.svelte.ts
+++ b/frontend/src/lib/components/flows/agentDraft.svelte.ts
@@ -438,6 +438,9 @@ export function useAgentDraft(opts: AgentDraftOptions): AgentDraftHandle {
 		// The counter the step card's write-back used to report, from the surface that now owns the
 		// write: a deploy here reaches every flow linking this agent.
 		logReusableAgentUsage(noDeployed ? 'saved' : 'updated')
+		// A new agent's editor opens on its draft's storage path, so its first save always lands
+		// elsewhere: that is naming it, not a rename.
+		const firstSave = noDeployed
 		deployed = submitted
 		noDeployed = false
 		const renamed = submitted.path !== fromPath
@@ -456,7 +459,9 @@ export function useAgentDraft(opts: AgentDraftOptions): AgentDraftHandle {
 		sync.discard(fromPath, submitted)
 		// A rename moves the row, so the next load must not reuse the old key.
 		loadedFor = `${ws}:${submitted.path}`
-		sendUserToast(renamed ? `Renamed agent to ${submitted.path}` : `Saved agent ${submitted.path}`)
+		sendUserToast(
+			renamed && !firstSave ? `Renamed agent to ${submitted.path}` : `Saved agent ${submitted.path}`
+		)
 		return submitted.path
 	}
 
diff --git a/frontend/src/lib/components/flows/content/AgentEditorHost.svelte b/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
index 9c2a57b43f..658a7adb77 100644
--- a/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
+++ b/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
@@ -9,7 +9,8 @@
 		AGENT_CHAT_SCHEMA,
 		agentChatFlow,
 		agentChatGap,
-		agentChatPath
+		agentChatPath,
+		AGENT_STEP_ID
 	} from '../conversations/agentEditorChat'
 	import { runFlowPreview } from '../utils.svelte'
 	import { goto } from '$lib/navigation'
@@ -100,7 +101,7 @@
 	 *  schema per tool — the linked branch deliberately loads none. Reserved in `forbiddenIds`:
 	 *  the root shares a flow-state map with the tools, so a tool of this id would lose its
 	 *  schema to the root's. */
-	const AGENT_ID = '__wm_agent_root'
+	const AGENT_ID = AGENT_STEP_ID
 
 	const draft = useAgentDraft({
 		path: () => path,
diff --git a/frontend/src/lib/components/flows/content/AgentEditorModal.svelte b/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
index 618c31dbaf..0280455e77 100644
--- a/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
+++ b/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
@@ -1,16 +1,8 @@
 <script lang="ts">
-	import {
-		ChevronRight,
-		FlaskConical,
-		Settings,
-		FormInput,
-		History,
-		MessageSquare,
-		Save
-	} from 'lucide-svelte'
+	import { FlaskConical, Settings, FormInput, History, MessageSquare, Save } from 'lucide-svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { onDestroy, untrack } from 'svelte'
+	import { onDestroy, untrack, type Snippet } from 'svelte'
 	import { resource } from 'runed'
 	import Modal, { type ModalTrailSegment } from '$lib/components/common/modal/Modal.svelte'
 	import PagedContent from '$lib/components/common/modal/PagedContent.svelte'
@@ -39,6 +31,10 @@
 	import AgentSettings from './AgentSettings.svelte'
 	import AgentEvalsModal from './AgentEvalsModal.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
+	import { emptyString } from '$lib/utils'
+	import Tooltip from '$lib/components/Tooltip.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
 
@@ -93,6 +89,9 @@
 	let host = $state<ReturnType<typeof AgentEditorHost> | undefined>(undefined)
 	let versionDrawer: Drawer | undefined = $state(undefined)
 	let settingsDrawer: Drawer | undefined = $state(undefined)
+	/** Held by the rename popover while it is open; the band's trail reads it so the path does not
+	 *  reflow under the pointer as the user types. */
+	let pathSnapshot = $state<string | undefined>(undefined)
 	let evalsModal: AgentEvalsModal | undefined = $state(undefined)
 	let saving = $state(false)
 
@@ -136,9 +135,10 @@
 	let canEvaluate = $derived(
 		draft != undefined && !draft.loading && !draftOnly && !readOnly && !refused
 	)
-	// A never-deployed agent is stored at a minted `draft_<uuid>` path, so it is named by the path
-	// its first deploy will create, as the home list names it.
-	let shownPath = $derived((draftOnly && draft?.state?.path) || target?.path)
+	// The draft's path, so a rename shows where it is typed — including a never-deployed agent,
+	// stored at a minted `draft_<uuid>` path and named by the path its first deploy will create,
+	// as the home list names it. Falls back to the target while the draft is still loading.
+	let shownPath = $derived(draft?.state?.path || target?.path)
 
 	// Where the evals pane is within itself, so its levels extend this dialog's trail rather than
 	// opening a dialog of their own. Cleared on the way in: the pane reports a level once it is on
@@ -312,34 +312,22 @@
 				{@render body()}
 			</Modal>
 		{:else}
+			<!-- On its own route the editor's header is the page header: the agent's path is the
+			     breadcrumb, the level it is on reads after that name, and its controls are the band's
+			     actions. -->
+			<PageHeaderContent
+				item={{
+					path: pathSnapshot ?? shownPath,
+					summaryContent: agentSummary,
+					// Only where the rename behind it can be saved: a reader who cannot write this agent
+					// keeps the segment that copies the path, rather than an editor with nothing to edit.
+					pathTrigger: readOnly ? undefined : agentPathTrigger
+				}}
+				afterName={agentHint}
+				actions={settings}
+				separator="always"
+			/>
 			<div class="h-full min-h-0 flex flex-col">
-				<div class="flex items-center gap-2 px-4 py-2 border-b shrink-0">
-					<div class="min-w-0 flex flex-col">
-						<div class="flex items-center gap-1 min-w-0">
-							{#each trail as segment, i (i)}
-								{#if i > 0}
-									<ChevronRight size={14} class="text-tertiary shrink-0" />
-								{/if}
-								{#if segment.onclick}
-									<Button variant="subtle" unifiedSize="sm" onClick={segment.onclick}>
-										{segment.label}
-									</Button>
-								{:else}
-									<span class="text-sm font-semibold text-emphasis truncate">{segment.label}</span>
-								{/if}
-								{#if i === 0}
-									{@render titleBadge()}
-								{/if}
-							{/each}
-							{@render levelBadge()}
-						</div>
-						{#if description}
-							<span class="text-2xs text-tertiary truncate">{description}</span>
-						{/if}
-					</div>
-					<div class="grow"></div>
-					{@render settings()}
-				</div>
 				<div class="flex-1 min-h-0 px-4 sm:px-6">
 					{@render body()}
 				</div>
@@ -347,6 +335,95 @@
 		{/if}
 	{/key}
 
+	<!-- The summary's editor again, hung off the band's path segment so it opens under the path,
+	     with the cursor in the path field. `bind:` cannot be spread, so the slots are written out
+	     twice; both instances bind the same ones and only one is ever open. -->
+	{#snippet agentPathTrigger(pathLabel: Snippet, triggerClass: string)}
+		<!-- Gated like the summary beside it: this renders from the band's tree, where `draft` is
+		     undefined for as long as the modal has not loaded one, and a getter that reads through it
+		     throws there rather than where it was written. The `{:else}` carries the whole load of
+		     that wait: the band gave up its own segment to this snippet, so without it the trail
+		     would show no path until the draft arrives. -->
+		{#if draft?.state}
+			<PathEditPopover
+				label={pathLabel}
+				{triggerClass}
+				focusField="path"
+				bind:summary={
+					() => draft.state?.description ?? '',
+					(v) => {
+						if (draft.state) draft.state.description = v
+					}
+				}
+				bind:path={
+					() => draft.state?.path ?? '',
+					(v) => {
+						if (draft.state) draft.state.path = v
+					}
+				}
+				bind:snapshotPath={pathSnapshot}
+				bind:error={() => host?.pathError(), (error) => host?.setPathError(error)}
+				savedPath={draft?.noDeployed ? undefined : target?.path}
+				kind="resource"
+				workspaceId={ws}
+				pathEditable={!readOnly}
+				summaryEditable={!readOnly}
+			/>
+		{:else}
+			<span class={triggerClass}>{@render pathLabel()}</span>
+		{/if}
+	{/snippet}
+
+	{#snippet agentSummary()}
+		<!-- What the agent is, beside what it is called, and clicking it renames both — the same
+		     shape the script, flow and app editors carry. The version rides along, as the
+		     linked-agent card in the step panel has it. The trail's levels are not here: this layout
+		     opens settings in a drawer and evals over the page, so it never stands on one. -->
+		<div class="flex items-center gap-1 min-w-0">
+			{#if draft?.state}
+				{#snippet summaryText()}
+					<span
+						class="min-w-0 truncate text-xs {emptyString(draft.state?.description)
+							? 'text-tertiary italic font-normal'
+							: 'font-medium text-emphasis'}"
+						title={draft.state?.description}
+						>{emptyString(draft.state?.description)
+							? 'Add a summary...'
+							: draft.state?.description}</span
+					>
+				{/snippet}
+				<PathEditPopover
+					label={summaryText}
+					bind:summary={
+						() => draft.state?.description ?? '',
+						(v) => {
+							if (draft.state) draft.state.description = v
+						}
+					}
+					bind:path={
+						() => draft.state?.path ?? '',
+						(v) => {
+							if (draft.state) draft.state.path = v
+						}
+					}
+					bind:snapshotPath={pathSnapshot}
+					bind:error={() => host?.pathError(), (error) => host?.setPathError(error)}
+					savedPath={draft?.noDeployed ? undefined : target?.path}
+					kind="resource"
+					workspaceId={ws}
+					pathEditable={!readOnly}
+					summaryEditable={!readOnly}
+					penVisibility={emptyString(draft.state.description) ? 'always' : 'hover'}
+				/>
+			{/if}
+			{@render titleBadge()}
+		</div>
+	{/snippet}
+	{#snippet agentHint()}
+		{#if description}
+			<Tooltip>{description}</Tooltip>
+		{/if}
+	{/snippet}
 	{#snippet titleBadge()}
 		<!-- Against the agent's own name wherever it appears, as the linked-agent card in the
 				     step panel has it. -->
diff --git a/frontend/src/lib/components/flows/content/FlowInputs.svelte b/frontend/src/lib/components/flows/content/FlowInputs.svelte
index f86d870a1a..41d860530a 100644
--- a/frontend/src/lib/components/flows/content/FlowInputs.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputs.svelte
@@ -291,6 +291,18 @@
 						})
 					}}
 				/>
+				<FlowScriptPicker
+					label="Pi"
+					lang="pisandbox"
+					on:click={() => {
+						dispatch('new', {
+							language: 'bun',
+							kind,
+							subkind: 'pisandbox',
+							summary
+						})
+					}}
+				/>
 			</div>
 		{/if}
 
diff --git a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
index 0b78193c6a..ecb3187c5c 100644
--- a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
@@ -267,28 +267,33 @@
 	)
 	let aiLength = $derived(showAiRows ? 2 : 0)
 
-	// Must match the heading and label rendered for the AI Sandbox section
 	const aiSandboxHeading = 'AI Sandbox'
-	const aiSandboxLabel = 'Claude Code'
-	let matchesAiSandbox = $derived.by(() => {
+	const aiSandboxes = [
+		{ label: 'Claude Code', subkind: 'claudesandbox' },
+		{ label: 'Pi', subkind: 'pisandbox' }
+	] as const
+	// A query matching the heading keeps every sandbox, otherwise only the ones it names.
+	let matchingAiSandboxes = $derived.by(() => {
 		const query = funcDesc?.trim().toLowerCase() ?? ''
-		if (query.length == 0) {
-			return true
-		}
-		return [aiSandboxHeading, aiSandboxLabel].some((term) => {
+		const matches = (term: string) => {
 			const lowered = term.toLowerCase()
 			return lowered.startsWith(query) || lowered.split(' ').some((w) => w.startsWith(query))
-		})
+		}
+		if (query.length == 0 || matches(aiSandboxHeading)) {
+			return aiSandboxes
+		}
+		return aiSandboxes.filter((s) => matches(s.label))
 	})
-	// Gates the AI Sandbox row and its slot in the index space; both must agree or arrow keys land
-	// on an index that renders nothing.
-	let showAiSandbox = $derived(
+	// Gates the AI Sandbox rows and their slots in the index space; both must agree or arrow keys
+	// land on an index that renders nothing.
+	let aiSandboxRows = $derived(
 		selectedKind === 'script' &&
 			preFilter === 'all' &&
 			!selected &&
 			customUi?.aiSandbox != false &&
-			!$operatorBuilderFlows &&
-			matchesAiSandbox
+			!$operatorBuilderFlows
+			? matchingAiSandboxes
+			: []
 	)
 
 	// Hub runnables carry code the workspace never reviewed, and the backend refuses them in a
@@ -301,7 +306,7 @@
 	let aiOffset = $derived(inlineOffset + (inlineScripts?.length ?? 0))
 	let workspaceOffset = $derived(aiOffset + aiLength)
 	let aiSandboxOffset = $derived(workspaceOffset + (filteredWorkspaceItems?.length ?? 0))
-	let hubOffset = $derived(aiSandboxOffset + (showAiSandbox ? 1 : 0))
+	let hubOffset = $derived(aiSandboxOffset + aiSandboxRows.length)
 </script>
 
 <svelte:window onkeydown={onKeyDown} />
@@ -530,27 +535,29 @@
 			{/await}
 			<div class="pb-1"></div>
 		{/if}
-		{#if showAiSandbox}
+		{#if aiSandboxRows.length > 0}
 			<div class="pb-0 text-2xs font-normal text-secondary ml-2">{aiSandboxHeading}</div>
-			<FlowScriptPickerQuick
-				eeRestricted={false}
-				selected={selectedByKeyboard === aiSandboxOffset}
-				onHover={() => hover(aiSandboxOffset)}
-				enterpriseLangs={[]}
-				label={aiSandboxLabel}
-				lang="claudesandbox"
-				on:click={() => {
-					dispatch('new', {
-						kind: selectedKind,
-						inlineScript: {
-							language: 'bun',
+			{#each aiSandboxRows as sandbox, i (sandbox.subkind)}
+				<FlowScriptPickerQuick
+					eeRestricted={false}
+					selected={selectedByKeyboard === aiSandboxOffset + i}
+					onHover={() => hover(aiSandboxOffset + i)}
+					enterpriseLangs={[]}
+					label={sandbox.label}
+					lang={sandbox.subkind}
+					on:click={() => {
+						dispatch('new', {
 							kind: selectedKind,
-							subkind: 'claudesandbox',
-							summary
-						}
-					})
-				}}
-			/>
+							inlineScript: {
+								language: 'bun',
+								kind: selectedKind,
+								subkind: sandbox.subkind,
+								summary
+							}
+						})
+					}}
+				/>
+			{/each}
 		{/if}
 		{#if showHub && selectedKind != 'preprocessor' && selectedKind != 'flow'}
 			{#if (!selected || selected?.kind === 'integrations') && (preFilter === 'hub' || preFilter === 'all')}
diff --git a/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte b/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
index 6dde4b8575..e80408c8cf 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
@@ -20,7 +20,7 @@
 	let customUi: undefined | FlowBuilderWhitelabelCustomUi = getContext('customUi')
 </script>
 
-<div class="flex shrink-0 flex-row gap-2 whitespace-nowrap">
+<div class="flex shrink-0 flex-row items-center gap-2 whitespace-nowrap">
 	{#if module.value.type === 'script'}
 		{#if customUi?.tagEdit != false}
 			<FlowModuleWorkerTagSelect
diff --git a/frontend/src/lib/components/flows/conversations/agentEditorChat.test.ts b/frontend/src/lib/components/flows/conversations/agentEditorChat.test.ts
index c00c1e4297..99db5b8a9f 100644
--- a/frontend/src/lib/components/flows/conversations/agentEditorChat.test.ts
+++ b/frontend/src/lib/components/flows/conversations/agentEditorChat.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import type { FlowModule } from '$lib/gen'
-import { agentChatFlow, agentChatGap, agentChatPath } from './agentEditorChat'
+import { agentChatFlow, agentChatGap, agentChatPath, agentStepLabel } from './agentEditorChat'
 
 describe('agentChatPath', () => {
 	it('is a path no flow can take, so a same-path flow never shares its conversations', () => {
@@ -10,6 +10,14 @@ describe('agentChatPath', () => {
 	})
 })
 
+describe('agentStepLabel', () => {
+	it("names a run's agent step by the agent, a chat turn's included", () => {
+		expect(agentStepLabel('f/support/agent')).toBe('f/support/agent')
+		expect(agentStepLabel(agentChatPath('f/support/agent'))).toBe('f/support/agent')
+		expect(agentStepLabel(undefined)).toBe('AI Agent')
+	})
+})
+
 function agent(inputTransforms: Record<string, any>): FlowModule {
 	return {
 		id: '__wm_agent_root',
diff --git a/frontend/src/lib/components/flows/conversations/agentEditorChat.ts b/frontend/src/lib/components/flows/conversations/agentEditorChat.ts
index b754e04bb8..0f1bc86bda 100644
--- a/frontend/src/lib/components/flows/conversations/agentEditorChat.ts
+++ b/frontend/src/lib/components/flows/conversations/agentEditorChat.ts
@@ -13,6 +13,15 @@ export function agentChatPath(agentPath: string): string {
 	return `${agentPath}.chat`
 }
 
+/** The id of the one step a saved agent's run is made of, as the server names it too: job-read
+ *  scoping and the run's agent detection match on it, so it is only ever relabeled for display. */
+export const AGENT_STEP_ID = '__wm_agent_root'
+
+/** What a run shows for that step: the agent it ran, read off the run's path. */
+export function agentStepLabel(runPath: string | undefined): string {
+	return runPath?.replace(/\.chat$/, '') || 'AI Agent'
+}
+
 /**
  * The inputs of the flow a saved agent is chatted with: the message, and the files the composer's
  * paperclip uploads. `user_message` is the name the server requires of a chat-mode run.
diff --git a/frontend/src/lib/components/flows/flowStateUtils.svelte.ts b/frontend/src/lib/components/flows/flowStateUtils.svelte.ts
index 9d85a07452..030897a63b 100644
--- a/frontend/src/lib/components/flows/flowStateUtils.svelte.ts
+++ b/frontend/src/lib/components/flows/flowStateUtils.svelte.ts
@@ -108,7 +108,7 @@ export async function pickFlow(
 export async function createInlineScriptModule(
 	language: RawScript['language'],
 	kind: Script['kind'],
-	subkind: 'pgsql' | 'flow' | 'claudesandbox' | undefined,
+	subkind: 'pgsql' | 'flow' | 'claudesandbox' | 'pisandbox' | undefined,
 	id: string,
 	summary?: string
 ): Promise<[FlowModule, FlowModuleState]> {
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte
index a0ec4759f5..c87e20139e 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte
@@ -4,6 +4,7 @@
 	import type { FlowNodeColorClasses } from '$lib/components/graph'
 	import { twMerge } from 'tailwind-merge'
 	import { getContext } from 'svelte'
+	import { AGENT_STEP_ID } from '../conversations/agentEditorChat'
 
 	// Detached mode (sessions): a step's editor is hidden until asked for, so add the
 	// hint to the name tooltip. Provided by FlowEditor; absent (=> false) elsewhere.
@@ -69,7 +70,8 @@
 	</Popover>
 
 	<div class="flex items-center space-x-2 relative" bind:clientWidth={idBadgeWidth}>
-		{#if id && id !== 'preprocessor' && !id.startsWith('failure') && !id.startsWith('subflow:')}
+		<!-- A saved agent's run is that one step, already named by the run page. -->
+		{#if id && id !== 'preprocessor' && id !== AGENT_STEP_ID && !id.startsWith('failure') && !id.startsWith('subflow:')}
 			<Badge
 				color="transparent"
 				class="border-none"
diff --git a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
index 9cf4bcd264..62ec111b6c 100644
--- a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
+++ b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
@@ -117,17 +117,21 @@
 		logReusableAgentUsage('linked')
 		dispatch('new', { kind: 'aiagent', agentPath })
 	}
-	function newClaudeSandbox() {
+	function newAiSandbox(subkind: 'claudesandbox' | 'pisandbox') {
 		dispatch('close')
 		dispatch('new', {
 			kind: 'script',
 			inlineScript: {
 				language: 'bun',
 				kind: 'script',
-				subkind: 'claudesandbox'
+				subkind
 			}
 		})
 	}
+	const aiSandboxes = [
+		{ label: 'Claude Code', subkind: 'claudesandbox' },
+		{ label: 'Pi', subkind: 'pisandbox' }
+	] as const
 
 	// Rows of the AI panes in render order. FlowInputsQuick owns the keyboard index for the other
 	// panes and is unmounted while these render, so the two never fight over Enter or the arrows.
@@ -137,7 +141,7 @@
 			return [newBlankAgent, ...saved.map((a) => () => newLinkedAgent(a.path))]
 		}
 		if (selectedKind === 'aisandbox') {
-			return [newClaudeSandbox]
+			return aiSandboxes.map((s) => () => newAiSandbox(s.subkind))
 		}
 		return []
 	})
@@ -418,14 +422,16 @@
 			</div>
 		{:else if selectedKind === 'aisandbox'}
 			<div class="h-full overflow-auto grow min-w-0 p-2 gap-1 flex flex-col">
-				<TopLevelNode
-					label="Claude Code"
-					neutral
-					returnIcon
-					selected={aiSelected === 0}
-					onSelect={newClaudeSandbox}
-					onHover={() => (selectedByKeyboard = 0)}
-				/>
+				{#each aiSandboxes as sandbox, i (sandbox.subkind)}
+					<TopLevelNode
+						label={sandbox.label}
+						neutral
+						returnIcon
+						selected={aiSelected === i}
+						onSelect={() => newAiSandbox(sandbox.subkind)}
+						onHover={() => (selectedByKeyboard = i)}
+					/>
+				{/each}
 			</div>
 		{:else}
 			<FlowInputsQuick
diff --git a/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte b/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
index 93909d13f3..0ae64f3a69 100644
--- a/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
+++ b/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
@@ -8,7 +8,7 @@
 	interface Props {
 		disabled?: boolean
 		label: string
-		lang?: SupportedLanguage | 'docker' | 'javascript' | 'claudesandbox' | undefined
+		lang?: SupportedLanguage | 'docker' | 'javascript' | 'claudesandbox' | 'pisandbox' | undefined
 		id?: string | undefined
 	}
 
diff --git a/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte b/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte
index 3ac279556f..673fce2525 100644
--- a/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte
+++ b/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte
@@ -7,7 +7,7 @@
 
 	interface Props {
 		label: string
-		lang?: SupportedLanguage | 'docker' | 'javascript' | 'claudesandbox' | undefined
+		lang?: SupportedLanguage | 'docker' | 'javascript' | 'claudesandbox' | 'pisandbox' | undefined
 		selected?: boolean
 		eeRestricted: boolean
 		enterpriseLangs?: string[]
diff --git a/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte b/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte
index 0c58f0fc73..a8f3e040c4 100644
--- a/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte
+++ b/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte
@@ -52,6 +52,7 @@
 		'AI Decision': { icon: Scale, iconClass: 'text-ai' },
 		'AI Sandbox': { icon: BotIcon, showChevron: true, iconClass: 'text-ai' },
 		'Claude Code': { icon: BotIcon, iconClass: 'text-ai' },
+		Pi: { icon: BotIcon, iconClass: 'text-ai' },
 		MCP: { icon: Plug },
 		'Web Search': { icon: Globe }
 	}
diff --git a/frontend/src/lib/components/git_sync/GitPushPreview.svelte b/frontend/src/lib/components/git_sync/GitPushPreview.svelte
index bed6d741d1..25207b767c 100644
--- a/frontend/src/lib/components/git_sync/GitPushPreview.svelte
+++ b/frontend/src/lib/components/git_sync/GitPushPreview.svelte
@@ -14,6 +14,7 @@ buttons — the setup dialog puts them in its own footer, the standalone modal i
 	import hubPaths from '$lib/hubPaths.json'
 	import { jobManager } from '$lib/services/JobManager'
 	import type { SyncResponse, SettingsObject } from '$lib/git-sync'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 
 	interface Props {
 		gitRepoResourcePath: string
@@ -39,7 +40,7 @@ buttons — the setup dialog puts them in its own footer, the standalone modal i
 	let showCliInstructions = $state(false)
 	const cliInstructions = $derived(`# Setup (only needed if local folder not initialized yet)
 npm install -g windmill-cli
-wmill workspace add ${$workspaceStore} ${$workspaceStore} ${window.location.origin}
+wmill workspace add ${$workspaceStore} ${$workspaceStore} ${apiBaseUrl()}/
 wmill init --workspace ${$workspaceStore} --repository ${gitRepoResourcePath}
 
 # Pull workspace content to git repository
diff --git a/frontend/src/lib/components/graph/graphBuilder.svelte.ts b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
index e5741137d7..98a03f8c0f 100644
--- a/frontend/src/lib/components/graph/graphBuilder.svelte.ts
+++ b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
@@ -38,7 +38,7 @@ export type InsertKind =
 export type InlineScript = {
 	language: RawScript['language']
 	kind: Script['kind']
-	subkind: 'pgsql' | 'flow' | 'claudesandbox'
+	subkind: 'pgsql' | 'flow' | 'claudesandbox' | 'pisandbox'
 	summary?: string
 	instructions?: string
 }
diff --git a/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte b/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte
index fecf82ee23..6a4d94db1f 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte
@@ -3,6 +3,7 @@
 	import { Handle, Position } from '@xyflow/svelte'
 	import { twMerge } from 'tailwind-merge'
 	import ContextMenu, { type ContextMenuItem } from '../../../common/contextmenu/ContextMenu.svelte'
+	import { contextMenuItemsFromMenu } from '../../../common/contextmenu/fromMenuItems'
 	import { getGraphContext } from '../../graphContext'
 	import type { Item } from '$lib/utils'
 
@@ -28,21 +29,7 @@
 	}: Props = $props()
 
 	let resolvedContextMenuItems: ContextMenuItem[] | undefined = $derived(
-		contextMenuItems ??
-			menuItems?.flatMap((item) => [
-				...(item.separatorTop
-					? [{ id: `${item.displayName}-divider`, label: '', divider: true }]
-					: []),
-				{
-					id: item.displayName,
-					label: item.displayName,
-					icon: item.icon,
-					disabled: item.disabled,
-					type: item.type,
-					shortcut: item.shortcut,
-					onClick: item.action as (() => void) | undefined
-				}
-			])
+		contextMenuItems ?? (menuItems && contextMenuItemsFromMenu(menuItems))
 	)
 
 	// NodeWrapper is reused outside the flow graph (e.g. the app decision-tree
diff --git a/frontend/src/lib/components/home/CreateActionsMenu.svelte b/frontend/src/lib/components/home/CreateActionsMenu.svelte
index 4b9e7f1e9b..3193438067 100644
--- a/frontend/src/lib/components/home/CreateActionsMenu.svelte
+++ b/frontend/src/lib/components/home/CreateActionsMenu.svelte
@@ -20,6 +20,7 @@
 		PanelLeftClose
 	} from 'lucide-svelte'
 	import BarsStaggered from '$lib/components/icons/BarsStaggered.svelte'
+	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
 	import { PythonIcon, TypeScriptIcon } from '$lib/components/common/languageIcons'
 	import { HOME_SHOW_CREATE_FLOW, HOME_SHOW_CREATE_APP } from '$lib/consts'
 	import { importFlowStore } from '$lib/components/flows/flowStore.svelte'
@@ -55,6 +56,23 @@
 		label: string
 		icon: typeof PythonIcon
 		onSelect: () => void
+		badge?: { label: string; class: string }
+		/** opened in a new tab from a link beside the variant */
+		docHref?: string
+		/** shown in the doc panel while the variant is hovered, instead of its option's */
+		doc?: Doc
+	}
+
+	/** what the doc panel shows */
+	type Doc = {
+		label: string
+		/** a lucide icon or a brand mark; rendered at 26px through both size APIs */
+		icon: any
+		accent: string
+		tagline: string
+		description: string
+		bullets: string[]
+		badge?: { label: string; class: string }
 	}
 
 	/** an importable artifact kind handled by the shared YAML/JSON import drawer */
@@ -87,6 +105,9 @@
 	const badgeAdvanced = 'bg-gray-100 text-gray-600 dark:bg-gray-700 dark:text-gray-300'
 	const badgeLegacy = 'bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-300'
 	const badgeAlpha = 'bg-emerald-100 text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-300'
+	const badgeRecommended = 'bg-blue-100 text-blue-700 dark:bg-blue-900/40 dark:text-blue-300'
+
+	const DBT_DOCS = 'https://www.windmill.dev/docs/getting_started/scripts_quickstart/dbt'
 
 	const allOptions: Option[] = [
 		{
@@ -200,7 +221,34 @@
 							'Asset-aware lineage'
 						],
 						onSelect: () => goto(`${base}/pipeline`),
-						badge: { label: 'Alpha', class: badgeAlpha }
+						badge: { label: 'Alpha', class: badgeAlpha },
+						variants: [
+							{
+								label: 'Windmill pipelines',
+								icon: Workflow,
+								badge: { label: 'Recommended', class: badgeRecommended },
+								onSelect: () => goto(`${base}/pipeline`)
+							},
+							{
+								label: 'dbt',
+								icon: DbtIcon,
+								docHref: DBT_DOCS,
+								onSelect: () => goto(`${base}/scripts/add?lang=dbt`),
+								doc: {
+									label: 'dbt',
+									icon: DbtIcon,
+									accent: 'orange',
+									tagline: 'Run an existing dbt project',
+									description:
+										'A pipeline is Windmill’s own abstraction; an existing dbt project stays a dbt project, and runs here unchanged as its own kind of script, with dbt still owning its models, refs and tests. All it needs is a warehouse configured under Settings → dbt. Its models show up in the asset graph as dbt:// nodes, next to whatever pipelines you do build, so you can adopt pipelines later, or never.',
+									bullets: [
+										'Your dbt project, unchanged',
+										'Needs a warehouse under Settings → dbt',
+										'Models appear as dbt:// assets'
+									]
+								}
+							}
+						]
 					}
 				] as Option[])
 			: []),
@@ -301,18 +349,25 @@
 	// per-row fan-out submenus: open to the right when there's room. The popover hugs
 	// the right viewport edge on most screens, so the default flip (right → left) would
 	// cover the doc panel — fall back below the trigger row instead.
+	const variantSubmenu = () =>
+		builders.createSubmenu({
+			positioning: {
+				placement: 'right-start',
+				gutter: 4,
+				flip: { fallbackPlacements: ['bottom-end', 'bottom-start', 'top-end', 'top-start'] },
+				fitViewport: true,
+				overflowPadding: 8
+			}
+		})
 	const {
 		elements: { subTrigger: wacSubTrigger, subMenu: wacSubMenu },
 		states: { subOpen: wacSubOpen }
-	} = builders.createSubmenu({
-		positioning: {
-			placement: 'right-start',
-			gutter: 4,
-			flip: { fallbackPlacements: ['bottom-end', 'bottom-start', 'top-end', 'top-start'] },
-			fitViewport: true,
-			overflowPadding: 8
-		}
-	})
+	} = variantSubmenu()
+	const {
+		elements: { subTrigger: pipelineSubTrigger, subMenu: pipelineSubMenu },
+		states: { subOpen: pipelineSubOpen }
+	} = variantSubmenu()
+	let variantSubOpen = $derived($wacSubOpen || $pipelineSubOpen)
 	const {
 		elements: { subTrigger: importSubTrigger, subMenu: importSubMenu },
 		states: { subOpen: importSubOpen }
@@ -378,7 +433,10 @@
 		if (isOpen && !wasOpen) {
 			logFeatureUsage('home', 'new_menu_open', { key: source })
 		}
-		if (!isOpen) activeKey = undefined
+		if (!isOpen) {
+			activeKey = undefined
+			activeVariantDoc = undefined
+		}
 		wasOpen = isOpen
 	})
 
@@ -389,17 +447,25 @@
 		// only persist the non-default (hidden) state, so a cleared key means "shown"
 		storeLocalSetting(SHOW_DOC_SETTING, value ? undefined : 'false')
 	}
-	// The pointer crosses the gutter outside the menu on its way into the Workflow-as-Code
-	// submenu, so leaving the menu keeps the panel while that submenu is open; it clears
-	// once the submenu closes with neither pointer nor focus left on the menu.
+	// The pointer crosses the gutter outside the menu on its way into a variant submenu,
+	// so leaving the menu keeps the panel while that submenu is open; it clears once the
+	// submenu closes with neither pointer nor focus left on the menu.
 	let menuEl: HTMLDivElement | undefined = $state(undefined)
 	$effect(() => {
-		if ($wacSubOpen || !menuEl) return
+		if (variantSubOpen || !menuEl) return
 		if (!menuEl.matches(':hover') && !menuEl.contains(document.activeElement)) {
 			activeKey = undefined
 		}
 	})
-	let active = $derived(options.find((o) => o.key === activeKey))
+	// A hovered variant with its own doc (dbt under Data pipelines) takes over the panel.
+	let activeVariantDoc: Doc | undefined = $state(undefined)
+	function highlightOption(key: string | undefined) {
+		activeKey = key
+		activeVariantDoc = undefined
+	}
+	let active: Doc | undefined = $derived(
+		activeVariantDoc ?? options.find((o) => o.key === activeKey)
+	)
 	let activeAc = $derived(active ? accentClasses[active.accent] : undefined)
 
 	// shared YAML/JSON import drawer, reused by every "Import …" extra
@@ -476,7 +542,7 @@
 		style={showDoc ? 'width: 780px;' : ''}
 		bind:this={menuEl}
 		onpointerleave={() => {
-			if (!$wacSubOpen) activeKey = undefined
+			if (!variantSubOpen) highlightOption(undefined)
 		}}
 	>
 		<div
@@ -492,7 +558,7 @@
 						<div
 							class="w-12 h-12 rounded-xl flex items-center justify-center shrink-0 {activeAc.tile}"
 						>
-							<active.icon size={26} class={activeAc.iconText} />
+							<active.icon size={26} width={26} height={26} class={activeAc.iconText} />
 						</div>
 						<div class="min-w-0">
 							<div class="flex flex-row items-center gap-2">
@@ -551,48 +617,92 @@
 						</span>
 					{/if}
 				{/snippet}
+				{#snippet variantRow(
+					option: Option,
+					ac: (typeof accentClasses)[string],
+					rowClass: string,
+					subTrigger: any,
+					subMenu: any,
+					subOpen: boolean
+				)}
+					<button
+						use:melt={subTrigger}
+						class={rowClass}
+						onfocusin={() => highlightOption(option.key)}
+						onpointerenter={() => highlightOption(option.key)}
+					>
+						{@render rowBody(option, ac)}
+						<ChevronRight size={14} class="shrink-0 text-tertiary" />
+					</button>
+					{#if subOpen}
+						<!-- The invisible `before:` margin bridges the gutter to the trigger row: when
+						     the submenu falls below its row, that gutter lies over the next row, and
+						     crossing it highlights that item, which closes the submenu. -->
+						<div
+							use:melt={subMenu}
+							use:hugViewportRight
+							class="pointer-events-auto z-[6001] flex flex-col gap-0.5 p-1 min-w-52 w-max rounded-lg border border-gray-200 dark:border-gray-700 bg-surface shadow-xl focus:outline-none before:absolute before:-inset-2 before:-z-10 before:content-['']"
+						>
+							{#each option.variants ?? [] as variant (variant.label)}
+								{@const VariantIcon = variant.icon}
+								<div class="flex flex-row items-center gap-1">
+									<button
+										use:melt={$item}
+										class="flex flex-row flex-1 items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
+										onclick={() => variant.onSelect()}
+										onfocusin={() => (activeVariantDoc = variant.doc)}
+										onpointerenter={() => (activeVariantDoc = variant.doc)}
+									>
+										<VariantIcon width={14} height={14} size={14} />
+										<span class="text-xs font-medium text-primary whitespace-nowrap">
+											{variant.label}
+										</span>
+										{#if variant.badge}
+											<span
+												class="shrink-0 rounded px-1.5 py-0.5 text-[10px] font-semibold uppercase tracking-wide {variant
+													.badge.class}"
+											>
+												{variant.badge.label}
+											</span>
+										{/if}
+									</button>
+									{#if variant.docHref}
+										<a
+											href={variant.docHref}
+											target="_blank"
+											rel="noreferrer"
+											class="px-2 text-[10px] text-tertiary hover:text-secondary hover:underline whitespace-nowrap"
+											onpointerenter={() => (activeVariantDoc = variant.doc)}
+										>
+											See documentation
+										</a>
+									{/if}
+								</div>
+							{/each}
+						</div>
+					{/if}
+				{/snippet}
 				{#each options as option (option.key)}
 					{@const ac = accentClasses[option.accent]}
 					{@const rowClass =
 						'w-full flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover'}
-					{#if option.variants}
-						<button
-							use:melt={$wacSubTrigger}
-							class={rowClass}
-							onfocusin={() => (activeKey = option.key)}
-							onpointerenter={() => (activeKey = option.key)}
-						>
-							{@render rowBody(option, ac)}
-							<ChevronRight size={14} class="shrink-0 text-tertiary" />
-						</button>
-						{#if $wacSubOpen}
-							<!-- The invisible `before:` margin bridges the gutter to the trigger row: when
-							     the submenu falls below its row, that gutter lies over the next row, and
-							     crossing it highlights that item, which closes the submenu. -->
-							<div
-								use:melt={$wacSubMenu}
-								use:hugViewportRight
-								class="pointer-events-auto z-[6001] flex flex-col gap-0.5 p-1 w-52 rounded-lg border border-gray-200 dark:border-gray-700 bg-surface shadow-xl focus:outline-none before:absolute before:-inset-2 before:-z-10 before:content-['']"
-							>
-								{#each option.variants ?? [] as variant (variant.label)}
-									{@const VariantIcon = variant.icon}
-									<button
-										use:melt={$item}
-										class="flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
-										onclick={() => variant.onSelect()}
-									>
-										<VariantIcon width={14} height={14} />
-										<span class="text-xs font-medium text-primary">{variant.label}</span>
-									</button>
-								{/each}
-							</div>
-						{/if}
+					{#if option.variants && option.key === 'pipeline'}
+						{@render variantRow(
+							option,
+							ac,
+							rowClass,
+							$pipelineSubTrigger,
+							$pipelineSubMenu,
+							$pipelineSubOpen
+						)}
+					{:else if option.variants}
+						{@render variantRow(option, ac, rowClass, $wacSubTrigger, $wacSubMenu, $wacSubOpen)}
 					{:else}
 						<button
 							use:melt={$item}
 							class={rowClass}
-							onfocusin={() => (activeKey = option.key)}
-							onpointerenter={() => (activeKey = option.key)}
+							onfocusin={() => highlightOption(option.key)}
+							onpointerenter={() => highlightOption(option.key)}
 							onclick={() => option.onSelect()}
 						>
 							{@render rowBody(option, ac)}
@@ -605,8 +715,8 @@
 				<button
 					use:melt={$importSubTrigger}
 					class="w-full flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
-					onfocusin={() => (activeKey = undefined)}
-					onpointerenter={() => (activeKey = undefined)}
+					onfocusin={() => highlightOption(undefined)}
+					onpointerenter={() => highlightOption(undefined)}
 				>
 					<div
 						class="w-6 h-6 rounded-md flex items-center justify-center shrink-0 bg-gray-100 dark:bg-gray-700"
diff --git a/frontend/src/lib/components/home/HomeAIChat.svelte b/frontend/src/lib/components/home/HomeAIChat.svelte
index a8e4d8b973..62479b70d1 100644
--- a/frontend/src/lib/components/home/HomeAIChat.svelte
+++ b/frontend/src/lib/components/home/HomeAIChat.svelte
@@ -46,10 +46,20 @@
 	import HomeConnectDrawer from './HomeConnectDrawer.svelte'
 	import { USER_SETTINGS_HASH } from '../sidebar/settings'
 	import { prefersSessionHandoff } from '../copilot/chat/global/gate'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import { pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
 	import { onboardingProfile } from '$lib/onboardingProfile'
 
 	const COLLAPSED_SETTING = 'home-ai-composer-collapsed'
 
+	/** Bar width from which the two side trips stand in the bar rather than folding into the menu.
+	 *  Home's trail is ~250px and the rest of its actions ~400, so this leaves room for both
+	 *  labelled buttons without the trail starting to truncate. Below it they fold back. */
+	const BAR_FITS_SIDE_TRIPS = 1024
+	const sideTripsInBar = $derived(pageHeader.barWidth >= BAR_FITS_SIDE_TRIPS)
+	const hubOffered = $derived(!$userStore?.operator && HOME_SHOW_HUB)
+
 	let value = $state('')
 	// The stock examples, unless the invite that brought this person here wrote prompts for
 	// them — those replace the set outright rather than joining it, since a prompt written
@@ -73,6 +83,26 @@
 		storeLocalSetting(COLLAPSED_SETTING, next ? 'true' : undefined)
 	}
 
+	// Removing puts the composer away rather than throwing it out, and the way back is one item in
+	// the band's menu — so the ellipsis flashes as it appears, in a corner nobody is watching while
+	// the hero collapses in the middle of the page.
+	//
+	// A keyframe animation, not a transition: this mounts in the same flush that collapses the
+	// hero, so the frame that would paint it at rest is the frame it is already told to leave, and
+	// one `requestAnimationFrame` is not reliably past that paint. The flash then goes straight to
+	// invisible without ever being drawn. Mounted only while pulsing, so each removal replays it.
+	const PULSE_MS = 1000
+	let pulsing = $state(false)
+	let pulseEndTimer: ReturnType<typeof setTimeout> | undefined
+
+	function removeComposer() {
+		setCollapsed(true)
+		if (reducedMotion.val) return
+		clearTimeout(pulseEndTimer)
+		pulsing = true
+		pulseEndTimer = setTimeout(() => (pulsing = false), PULSE_MS)
+	}
+
 	// In global-AI mode the layout's chat panel is disabled and never loads the copilot
 	// config, so the home chat loads it for the current workspace itself.
 	$effect(() => {
@@ -107,8 +137,9 @@
 	// unlocked, so the far commoner unlocked workspace never pops the composer in mid-load.
 	let runOnlyWorkspace = $derived(isRuleActive('DisableDirectDeployment'))
 
-	// The composer hands off to /sessions, which refuses operators — so hide it from them (the
-	// prompt would be silently dropped) while the AI-independent CLI/MCP row below stays.
+	// The composer hands off to /sessions, which refuses operators and users opted out of the
+	// sessions beta — so hide it from them (the prompt would be silently dropped) while the
+	// AI-independent CLI/MCP row below stays.
 	let showComposer = $derived(
 		prefersSessionHandoff($userStore?.operator) &&
 			!runOnlyWorkspace &&
@@ -116,7 +147,7 @@
 	)
 
 	// The hero's margins and centered column are for the full block. The lone button row left
-	// by a collapsed, operator, run-only or hidden-assistant view is a hint line and should
+	// by a collapsed, opted-out, run-only or hidden-assistant view is a hint line and should
 	// cost the page almost nothing: no top margin, and the content column's full width so it
 	// hugs the right edge instead of floating centered in empty space.
 	let hero = $derived(showComposer && !collapsed)
@@ -149,7 +180,7 @@
 	const FADE_MS = 600
 
 	// Rotate the example prompt every CYCLE_MS: fade the placeholder out, swap it, fade it back in.
-	// Only while the composer is shown — otherwise (operators) it would loop forever driving an
+	// Only while the composer is shown — otherwise it would loop forever driving an
 	// unrendered input — and not under reduced motion, where the first prompt simply stays put.
 	// The index lives outside the effect so re-showing the composer resumes the rotation from the
 	// prompt currently displayed rather than restarting it.
@@ -185,7 +216,7 @@
 				<!-- The one dismiss control while the composer is usable; the overlay below carries its
 				     own once it takes over, so the two never show at the same time. -->
 				<div class="absolute right-0 top-0 z-20">
-					<CloseButton small noBg title="Hide Build with AI" onClick={() => setCollapsed(true)} />
+					<CloseButton small noBg title="Remove session chat" onClick={removeComposer} />
 				</div>
 			{/if}
 			<div class="flex items-center justify-center gap-2 mb-4">
@@ -272,9 +303,7 @@
 									{freeTierExhausted ? 'Add your own API key' : 'Configure AI'}
 								</Button>
 							{/if}
-							<Button unifiedSize="sm" variant="default" onClick={() => setCollapsed(true)}>
-								Hide
-							</Button>
+							<Button unifiedSize="sm" variant="default" onClick={removeComposer}>Remove</Button>
 						</div>
 					</div>
 				{/if}
@@ -295,49 +324,106 @@
 						</Button>
 					{/each}
 				</div>
-			{:else if showComposer}
-				<!-- All that is left of the composer once dismissed: sits with the CLI/MCP row so the
-				     collapsed home page is one quiet line. -->
-				<Button
-					variant="subtle"
-					unifiedSize="xs"
-					btnClasses="!text-2xs !text-hint"
-					startIcon={{ icon: WandSparkles }}
-					onClick={() => setCollapsed(false)}
-				>
-					Build with AI
-				</Button>
-			{:else}
-				<div></div>
 			{/if}
-
-			<!-- Not AI-related, so shown even to operators / when the composer is hidden. -->
-			<div class="flex flex-row items-center gap-1">
-				<Button
-					variant="subtle"
-					unifiedSize="xs"
-					btnClasses="!text-2xs !text-hint"
-					startIcon={{ icon: PlugZap }}
-					onClick={() => homeConnectDrawer?.openDrawer?.()}
-				>
-					CLI / MCP
-				</Button>
-				{#if !$userStore?.operator && HOME_SHOW_HUB}
-					<Button
-						variant="subtle"
-						unifiedSize="xs"
-						btnClasses="!text-2xs !text-hint"
-						startIcon={{ icon: Globe2 }}
-						endIcon={{ icon: ExternalLink }}
-						href={$hubBaseUrlStore}
-						target="_blank"
-					>
-						Hub
-					</Button>
-				{/if}
-			</div>
 		</div>
 	</div>
 </div>
 
 <HomeConnectDrawer bind:this={homeConnectDrawer} />
+
+<!-- Everything the hero offered beside the composer lives in the band's menu: the connect helper,
+     the hub, and the way back to the composer once it has been put away. -->
+<!-- Last in the bar whatever else the page registers: a menu of side trips belongs after the
+     buttons that act on what is on screen. -->
+<PageHeaderContent actions={homeMenu} actionsOrder={100} />
+
+{#snippet homeMenu()}
+	<!-- The band's own menu: the connect helper, the hub, and whether the composer is on this page
+	     — all of them preferences or side trips, none of them the page's work. -->
+	<span class="flex items-center gap-1">
+		<!-- Wide enough, and the two side trips are buttons of their own: a menu is where a thing
+		     goes when the bar cannot hold it, not where it belongs. They fold back below the width
+		     above. -->
+		{#if sideTripsInBar}
+			<!-- The same quiet shape the hero gave them before the bar took them: xs, hint-coloured,
+			     and the hub keeps its outbound mark. They sit beside the page's own buttons, and a
+			     side trip should not read as loudly as the thing the page is for. -->
+			<Button
+				variant="subtle"
+				unifiedSize="xs"
+				btnClasses="!text-2xs !text-hint"
+				startIcon={{ icon: PlugZap }}
+				onClick={() => homeConnectDrawer?.openDrawer?.()}
+			>
+				CLI / MCP
+			</Button>
+			{#if hubOffered}
+				<Button
+					variant="subtle"
+					unifiedSize="xs"
+					btnClasses="!text-2xs !text-hint"
+					startIcon={{ icon: Globe2 }}
+					endIcon={{ icon: ExternalLink }}
+					href={$hubBaseUrlStore}
+					target="_blank"
+				>
+					Hub
+				</Button>
+			{/if}
+		{/if}
+		<!-- Nothing left to hold once the side trips stand in the bar and the composer is on the
+		     page: an ellipsis that opens an empty menu is a button that does nothing. -->
+		<!-- No menu while the hero is on the page and its side trips are in the bar: the hero's own
+		     cross removes it, so an ellipsis holding a second way to do that is a button whose only
+		     item is a duplicate. -->
+		{#if !sideTripsInBar || (showComposer && collapsed)}
+			<!-- The flash rides the ellipsis itself, not the row: with the side trips beside it the
+			     row is three controls wide, and marking all three names none of them. -->
+			<span class="relative inline-flex">
+				{#if pulsing}
+					<!-- `opacity-0` at rest: the keyframes carry no fill mode, so at the end of the
+					     animation the element returns to its own opacity. At 1 that is the flash coming
+					     back at full strength until the unmount timer catches up. -->
+					<span
+						aria-hidden="true"
+						class="pointer-events-none absolute -inset-1 rounded-lg bg-blue-500/30 opacity-0 animate-fade-out"
+					></span>
+				{/if}
+				<DropdownV2
+					placement="bottom-end"
+					size="sm"
+					items={[
+						...(showComposer && collapsed
+							? [
+									{
+										displayName: 'Pin session hero to homepage',
+										icon: WandSparkles,
+										action: () => setCollapsed(false)
+									}
+								]
+							: []),
+						...(sideTripsInBar
+							? []
+							: [
+									{
+										displayName: 'CLI / MCP',
+										icon: PlugZap,
+										action: () => homeConnectDrawer?.openDrawer?.()
+									},
+									...(hubOffered
+										? [
+												{
+													displayName: 'Hub',
+													icon: Globe2,
+													href: $hubBaseUrlStore,
+													hrefTarget: '_blank' as const
+												}
+											]
+										: [])
+								])
+					]}
+				/>
+			</span>
+		{/if}
+	</span>
+{/snippet}
diff --git a/frontend/src/lib/components/home/HomeConnectDrawer.svelte b/frontend/src/lib/components/home/HomeConnectDrawer.svelte
index e08ac2ddea..2b86025549 100644
--- a/frontend/src/lib/components/home/HomeConnectDrawer.svelte
+++ b/frontend/src/lib/components/home/HomeConnectDrawer.svelte
@@ -6,6 +6,7 @@
 	import { Bot, ExternalLink, Terminal } from 'lucide-svelte'
 	import { shell } from 'svelte-highlight/languages'
 	import { mcpTokenUrlDisabled } from '$lib/mcpAuth'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 
 	type ConnectTab = 'cli' | 'mcp'
 
@@ -14,7 +15,7 @@
 	let selectedTab: ConnectTab = $state('cli')
 	let openVersion = $state(0)
 
-	const origin = $derived(typeof window === 'undefined' ? '' : window.location.origin)
+	const origin = $derived(typeof window === 'undefined' ? '' : `${apiBaseUrl()}/`)
 	const workspaceId = $derived($workspaceStore ?? '<workspace>')
 	const cliCommands = $derived(`npm install -g windmill-cli
 wmill workspace add ${workspaceId} ${workspaceId} ${origin}
@@ -55,7 +56,8 @@ wmill sync pull`)
 												<h3 class="text-sm font-semibold text-emphasis">Local setup</h3>
 												<p class="text-xs text-secondary max-w-xl">
 													Run this in your local repo to bind the current workspace, create
-													<code class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
+													<code
+														class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
 														>wmill.yaml</code
 													>, and pull the latest files.
 												</p>
@@ -80,15 +82,18 @@ wmill sync pull`)
 										/>
 
 										<p class="text-2xs text-secondary">
-											<code class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
+											<code
+												class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
 												>wmill workspace add</code
 											>
 											will handle authentication,
-											<code class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
+											<code
+												class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
 												>wmill init</code
 											>
 											bootstraps the local config, and
-											<code class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
+											<code
+												class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
 												>wmill sync pull</code
 											>
 											fetches the workspace content.
diff --git a/frontend/src/lib/components/home/Item.svelte b/frontend/src/lib/components/home/Item.svelte
index a8837d555a..67dac7b3dd 100644
--- a/frontend/src/lib/components/home/Item.svelte
+++ b/frontend/src/lib/components/home/Item.svelte
@@ -45,10 +45,9 @@
 	// A raw app the listing returns is an `app` row carrying `raw_app`, and is
 	// selectable like any other app. The separate `raw_app` type is the legacy
 	// listing shape, which renders through RawAppRow — no selection control there,
-	// so it must not enter the selection either. An agent is a resource underneath,
-	// which none of the bulk actions handle.
+	// so it must not enter the selection either.
 	let bulkItem = $derived(
-		homeSelection?.available && item.type !== 'raw_app' && item.type !== 'agent'
+		homeSelection?.available && item.type !== 'raw_app'
 			? toBulkItem(item, $userStore, $workspaceStore)
 			: undefined
 	)
@@ -145,6 +144,7 @@
 		{depth}
 		bind:menuOpen
 		{keyboardSelected}
+		{rowSelection}
 	/>
 {/if}
 
diff --git a/frontend/src/lib/components/home/ItemsList.svelte b/frontend/src/lib/components/home/ItemsList.svelte
index 82a2623c58..be706723bc 100644
--- a/frontend/src/lib/components/home/ItemsList.svelte
+++ b/frontend/src/lib/components/home/ItemsList.svelte
@@ -64,15 +64,13 @@
 	import { effectivePath, type ItemType } from './treeViewUtils'
 	import { tick, untrack } from 'svelte'
 	import { triggerableByAI } from '$lib/actions/triggerableByAI.svelte'
-	import { NetworkIcon } from 'lucide-svelte'
-	import { base } from '$lib/base'
+	import PipelineRow from '../common/table/PipelineRow.svelte'
 	import BulkActionsBar from './BulkActionsBar.svelte'
 	import { HomeSelection, setHomeSelection, toBulkItem } from './homeSelection.svelte'
 	import { HomeActivity, setHomeActivity } from './homeActivity.svelte'
 	import {
 		HOME_TABLE_BADGE_GRID,
 		HOME_TABLE_GRID,
-		HOME_TABLE_ROW_SEPARATOR,
 		HOME_TABLE_WIDE_ACTIONS,
 		setHomeTable
 	} from './homeTable'
@@ -850,6 +848,8 @@
 		// A row action can add, toggle or remove a trigger, or start a run.
 		homeActivity.reset()
 		void ownerCountsRes.refetch()
+		// Deleting a pipeline removes it from this list, which no item reload covers.
+		void pipelineFoldersRes.refetch()
 		await reloadItems()
 		await tick()
 		homeSelection.dropVanished(renderedBefore)
@@ -1842,8 +1842,7 @@
 				homeSelection.active &&
 				selectedIndex >= 0 &&
 				selectedIndex < displayedItems.length &&
-				displayedItems[selectedIndex].type !== 'raw_app' &&
-				displayedItems[selectedIndex].type !== 'agent'
+				displayedItems[selectedIndex].type !== 'raw_app'
 			) {
 				e.preventDefault()
 				homeSelection.toggle(
@@ -2173,13 +2172,7 @@
 				{@render tableHeader()}
 				{#if filter === ''}
 					{#each [...visiblePipelineFolders].sort() as folder (folder)}
-						<a
-							href="{base}/pipeline/{encodeURIComponent(folder)}"
-							class="w-full inline-flex items-center gap-4 pl-5 pr-3 py-2 {HOME_TABLE_ROW_SEPARATOR} hover:bg-surface-hover transition-colors text-sm"
-						>
-							<NetworkIcon size={16} class="text-emerald-600 dark:text-emerald-400" />
-							<span class="text-xs font-medium text-emphasis truncate">Pipeline · f/{folder}</span>
-						</a>
+						<PipelineRow {folder} onDeleted={reloadItemsAndCounts} />
 					{/each}
 				{/if}
 				{#each displayedItems as item, i (item.type + '/' + item.path + (item.hash ? '/' + item.hash : ''))}
diff --git a/frontend/src/lib/components/home/RunnableActivityCells.svelte b/frontend/src/lib/components/home/RunnableActivityCells.svelte
index bd6e338a67..3a24d4be83 100644
--- a/frontend/src/lib/components/home/RunnableActivityCells.svelte
+++ b/frontend/src/lib/components/home/RunnableActivityCells.svelte
@@ -60,7 +60,7 @@
 	): string | undefined {
 		const dow = formatCron(cron.trim()).split(/\s+/)[5]
 		if (cronVersion === 'v1' && dow !== undefined && dow !== '*' && dow !== '?') return undefined
-		return describeSchedule(cron, timezone)
+		return describeSchedule(cron, timezone, { compact: true })
 	}
 
 	type RunStatus = (typeof runs)[number]['status']
diff --git a/frontend/src/lib/components/home/TreeView.svelte b/frontend/src/lib/components/home/TreeView.svelte
index cf9bfcb869..b6fbfb649f 100644
--- a/frontend/src/lib/components/home/TreeView.svelte
+++ b/frontend/src/lib/components/home/TreeView.svelte
@@ -1,15 +1,15 @@
 <script lang="ts">
 	import TreeView from './TreeView.svelte'
-	import { onDestroy, untrack, type Snippet } from 'svelte'
+	import { createEventDispatcher, onDestroy, untrack, type Snippet } from 'svelte'
 	import ResizeTransitionWrapper from '$lib/components/common/ResizeTransitionWrapper.svelte'
 
-	import { ChevronDown, ChevronUp, Folder, FolderTree, NetworkIcon, User } from 'lucide-svelte'
+	import { ChevronDown, ChevronUp, Folder, FolderTree, User } from 'lucide-svelte'
+	import PipelineRow from '../common/table/PipelineRow.svelte'
 	import Item from './Item.svelte'
 	import { countLeaves, type FolderItem, type ItemType, type UserItem } from './treeViewUtils'
 	import { twMerge } from 'tailwind-merge'
 	import { HOME_TABLE_ROW_SEPARATOR, isHomeTable } from './homeTable'
 	import { pluralize } from '$lib/utils'
-	import { base } from '$lib/base'
 	import { Button } from '$lib/components/common'
 
 	interface Props {
@@ -80,6 +80,8 @@
 
 	let visualDepth = $derived(depth + indent)
 
+	const dispatch = createEventDispatcher<{ reload: void }>()
+
 	// Bounds the request burst from "expand all": however many root owners the tree
 	// renders (its slice grows as you scroll), it fetches at most this many. Lazy owners
 	// past the cap stay collapsed and load on a single click (see the effect).
@@ -322,17 +324,12 @@
 			{#if opened || isSearching}
 				<div>
 					{#if hasPipeline && isFolder(item)}
-						<!-- py-3 matches common/table/Row.svelte so this row sits at
-					     the same height as the script/flow/app rows that follow
-					     it under the same folder; py-2 was visibly shorter. -->
-						<a
-							href="{base}/pipeline/{encodeURIComponent(item.folderName)}"
-							class="flex items-center gap-4 px-4 py-3 {separator} text-sm hover:bg-surface-hover transition-colors"
-							style="padding-left: {(visualDepth + 1) * 16}px;"
-						>
-							<NetworkIcon size={16} class="text-emerald-600 dark:text-emerald-400" />
-							<span class="text-xs font-medium text-emphasis">Pipeline</span>
-						</a>
+						<PipelineRow
+							folder={item.folderName}
+							depth={visualDepth + 1}
+							label="Pipeline"
+							onDeleted={() => dispatch('reload')}
+						/>
 					{/if}
 					{#each item.items.slice(0, effectiveMax) as subItem, index ((subItem['path'] ? subItem['type'] + '__' + subItem['path'] + '__' + index : undefined) ?? 'folder__' + subItem['folderName'] + '__' + index)}
 						<TreeView
diff --git a/frontend/src/lib/components/home/bulkActions.test.ts b/frontend/src/lib/components/home/bulkActions.test.ts
index ccc29d063e..e00d5f5da5 100644
--- a/frontend/src/lib/components/home/bulkActions.test.ts
+++ b/frontend/src/lib/components/home/bulkActions.test.ts
@@ -57,6 +57,15 @@ describe('blockedReason', () => {
 		expect(blockedReason('unarchive', item({ archived: false }), admin)).toBeDefined()
 	})
 
+	// AgentRow's delete is `disabled: !canWrite`; the server moves no resource draft.
+	it('gates an agent as its row does, and keeps a draft-only one in place', () => {
+		const agent = item({ kind: 'agent', owner: false })
+		expect(blockedReason('delete', agent, member)).toBeUndefined()
+		expect(blockedReason('delete', { ...agent, canWrite: false }, member)).toBeDefined()
+		expect(blockedReason('archive', agent, admin)).toBeDefined()
+		expect(blockedReason('move', item({ kind: 'agent', draftOnly: true }), admin)).toBeDefined()
+	})
+
 	it('lets a draft-only row move or discard, never archive/delete', () => {
 		const draftOnly = item({ draftOnly: true, isDraft: true })
 		expect(blockedReason('discard', draftOnly, admin)).toBeUndefined()
diff --git a/frontend/src/lib/components/home/bulkActions.ts b/frontend/src/lib/components/home/bulkActions.ts
index 2345311459..20a65ec596 100644
--- a/frontend/src/lib/components/home/bulkActions.ts
+++ b/frontend/src/lib/components/home/bulkActions.ts
@@ -8,18 +8,19 @@
  * addresses the deployed row. A draft-only item is therefore not deletable —
  * there is nothing deployed at its path.
  */
-import { AppService, DraftService, FlowService, ScriptService } from '$lib/gen'
+import { AppService, DraftService, FlowService, ResourceService, ScriptService } from '$lib/gen'
 import type { UserDraftItemKind } from '$lib/gen'
 import { updateItemPathAndSummary } from '$lib/components/moveRenameManager'
 import { discardDraft } from '$lib/utils_draft_deploy'
 import type { BulkItem } from './homeSelection.svelte'
 
-/** The draft overlay is the one place a raw app is its own kind. Narrowed to the
- * four kinds `moveDraft` accepts — a `BulkItem` is never anything else, and
- * saying so lets the compiler check that rather than trusting it. */
+/** The draft overlay is the one place a raw app is its own kind, and an agent's
+ * draft is filed as the resource it is. Narrowed so the compiler checks that a
+ * `BulkItem` never maps to anything else. */
 function draftKind(
 	item: BulkItem
-): Extract<UserDraftItemKind, 'script' | 'flow' | 'app' | 'raw_app'> {
+): Extract<UserDraftItemKind, 'script' | 'flow' | 'app' | 'raw_app' | 'resource'> {
+	if (item.kind === 'agent') return 'resource'
 	return item.kind === 'app' && item.rawApp ? 'raw_app' : item.kind
 }
 
@@ -43,6 +44,9 @@ export function blockedReason(
 	switch (action) {
 		case 'move':
 			if (item.archived) return 'archived items cannot be moved'
+			// The server moves only script, flow and app drafts.
+			if (item.kind === 'agent' && item.draftOnly)
+				return 'a draft-only agent is moved by changing its path in the editor'
 			if (!item.owner) return notOwner
 			if (!item.canWrite) return 'you do not have write permission on this path'
 			return undefined
@@ -94,9 +98,11 @@ async function moveItem(ctx: BulkContext, item: BulkItem, target: string): Promi
 	if (item.draftOnly) {
 		// Nothing is deployed at this path, so there is no deploy to re-run: the
 		// item IS its draft row, and moving it rewrites that row.
+		const kind = draftKind(item)
+		if (kind === 'resource') throw new Error('a draft-only agent cannot be moved here')
 		await DraftService.moveDraft({
 			workspace: ctx.workspace,
-			kind: draftKind(item),
+			kind,
 			path: item.path,
 			requestBody: { new_path: newPath }
 		})
@@ -138,6 +144,8 @@ async function deleteItem(ctx: BulkContext, item: BulkItem): Promise<void> {
 		await ScriptService.deleteScriptByPath({ workspace: ctx.workspace, path: item.path })
 	} else if (item.kind === 'flow') {
 		await FlowService.deleteFlowByPath({ workspace: ctx.workspace, path: item.path })
+	} else if (item.kind === 'agent') {
+		await ResourceService.deleteResource({ workspace: ctx.workspace, path: item.path })
 	} else {
 		await AppService.deleteApp({ workspace: ctx.workspace, path: item.path })
 	}
diff --git a/frontend/src/lib/components/home/homeSelection.svelte.ts b/frontend/src/lib/components/home/homeSelection.svelte.ts
index 953292ef14..5f080cbdbc 100644
--- a/frontend/src/lib/components/home/homeSelection.svelte.ts
+++ b/frontend/src/lib/components/home/homeSelection.svelte.ts
@@ -13,7 +13,7 @@ import type { UserExt } from '$lib/stores'
 /** A raw app is not a kind of its own here: the listing returns it as an `app`
  * row carrying `raw_app`, which every action addresses through `BulkItem.rawApp`
  * (only the draft overlay distinguishes the two). */
-export type BulkKind = 'script' | 'flow' | 'app'
+export type BulkKind = 'script' | 'flow' | 'app' | 'agent'
 
 /** The flattened row facts every bulk action needs, snapshotted at selection
  * time so an action still knows what it is acting on after the list reloads. */
diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index 9701b74e30..75dada92ab 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -175,8 +175,7 @@ export function isValidWebhookBaseUrl(value: unknown): boolean {
 	return (
 		(url.protocol === 'http:' || url.protocol === 'https:') &&
 		url.host !== '' &&
-		// Userinfo would end up in the per-repository receiver stored in workspace
-		// settings, which workspace admins can read.
+		// Userinfo would end up in URLs that users who are not instance admins can read.
 		url.username === '' &&
 		url.password === '' &&
 		// Tested on the raw string, not `url.search`/`url.hash`: those are `''` for a
@@ -187,6 +186,8 @@ export function isValidWebhookBaseUrl(value: unknown): boolean {
 		// `new URL` silently percent-encodes a space in the path, where the server
 		// rejects it outright.
 		!/\s/.test(trimmed) &&
+		// Shell-active characters: the URL is pasted into commands users copy.
+		!/[$`'"\\;&|<>(){}*!]/.test(trimmed) &&
 		!trimmed.endsWith('/')
 	)
 }
@@ -207,7 +208,29 @@ export const settings: Record<string, Setting[]> = {
 				(value?.startsWith('http') &&
 					value.includes('://') &&
 					!value?.endsWith('/') &&
-					!value?.endsWith(' '))
+					!value?.endsWith(' ')),
+			advancedToggle: {
+				label: 'The API is served on a different url than the UI',
+				onChange(values) {
+					values['api_base_url'] = values['api_base_url'] == null ? '' : null
+					return values
+				},
+				checked: (values) => values['api_base_url'] != null
+			}
+		},
+		{
+			label: 'API base url',
+			description:
+				'Base url shown to users for the endpoints external clients call (webhooks, HTTP routes, push trigger endpoints, the CLI remote), without trailing slash. Leave empty to show the url the UI is browsed on. Set it when the API is served on a separate domain or behind an API gateway. If that url does not also serve the UI, the CLI must authenticate with a token rather than the browser login.',
+			key: 'api_base_url',
+			fieldType: 'text',
+			placeholder: 'https://api.windmill.company.com',
+			storage: 'setting',
+			ee_only: '',
+			hiddenIfNull: true,
+			error:
+				'API base url must be an http:// or https:// url with a host, no embedded username or password, no query string or fragment, no shell metacharacters, and no trailing slash',
+			isValid: isValidWebhookBaseUrl
 		},
 		{
 			label: 'Email domain',
@@ -1223,7 +1246,7 @@ export const settings: Record<string, Setting[]> = {
 			storage: 'setting',
 			ee_only: '',
 			error:
-				'Webhook base url must be an http:// or https:// url with a host, no embedded username or password, no query string or fragment, and no trailing slash',
+				'Webhook base url must be an http:// or https:// url with a host, no embedded username or password, no query string or fragment, no shell metacharacters, and no trailing slash',
 			isValid: isValidWebhookBaseUrl
 		}
 	],
diff --git a/frontend/src/lib/components/instanceSettingsWebhookBaseUrl.test.ts b/frontend/src/lib/components/instanceSettingsWebhookBaseUrl.test.ts
index c8545b073e..175a251315 100644
--- a/frontend/src/lib/components/instanceSettingsWebhookBaseUrl.test.ts
+++ b/frontend/src/lib/components/instanceSettingsWebhookBaseUrl.test.ts
@@ -29,7 +29,10 @@ const REJECTED = [
 	'https://hooks.example.com?',
 	'https://hooks.example.com#',
 	'https://user:password@hooks.example.com',
-	'https://user@hooks.example.com'
+	'https://user@hooks.example.com',
+	'https://hooks.example.com/$(uname)',
+	'https://hooks.example.com/`uname`',
+	'https://hooks.example.com/a;b'
 ]
 
 describe('isValidWebhookBaseUrl', () => {
@@ -41,10 +44,13 @@ describe('isValidWebhookBaseUrl', () => {
 		expect(isValidWebhookBaseUrl(value)).toBe(false)
 	})
 
-	it.each([true, 42, {}, [], null] as unknown[])('rejects the non-string %j without throwing', (value) => {
-		// `Setting.isValid` is typed `any` and YAML mode can supply any JSON shape.
-		expect(isValidWebhookBaseUrl(value as never)).toBe(value === null)
-	})
+	it.each([true, 42, {}, [], null] as unknown[])(
+		'rejects the non-string %j without throwing',
+		(value) => {
+			// `Setting.isValid` is typed `any` and YAML mode can supply any JSON shape.
+			expect(isValidWebhookBaseUrl(value as never)).toBe(value === null)
+		}
+	)
 
 	it('treats unset and blank as valid, since the setting is optional', () => {
 		expect(isValidWebhookBaseUrl(undefined)).toBe(true)
diff --git a/frontend/src/lib/components/meltComponents/Menu.svelte b/frontend/src/lib/components/meltComponents/Menu.svelte
index ab6de64123..02ed1d90f7 100644
--- a/frontend/src/lib/components/meltComponents/Menu.svelte
+++ b/frontend/src/lib/components/meltComponents/Menu.svelte
@@ -16,6 +16,10 @@
 
 	interface Props {
 		placement?: Placement
+		/** Inline style on the panel. A margin here shifts it after floating-ui has placed it,
+		 *  which is the only way to anchor it to a box wider than the trigger: melt's menubar
+		 *  menu ignores `positioning.offset`. */
+		contentStyle?: string
 		justifyEnd?: boolean
 		lightMode?: boolean
 		maxHeight?: number
@@ -45,6 +49,7 @@
 
 	let {
 		placement = 'right-start',
+		contentStyle = '',
 		justifyEnd = false,
 		lightMode = false,
 		maxHeight = 900,
@@ -221,6 +226,7 @@
 			onmouseenter={cancelPendingClose}
 			onmouseleave={scheduleClose}
 			transition:placementFly={{ duration: 100, placement }}
+			style={contentStyle}
 			class={twMerge(
 				'z-[6000] border w-56 origin-top-right rounded-md shadow-md focus:outline-none',
 				// Default: scroll on the melt element. submenuSafe moves it to the inner
diff --git a/frontend/src/lib/components/moveRenameManager.ts b/frontend/src/lib/components/moveRenameManager.ts
index 1500f8fc69..e5844a3351 100644
--- a/frontend/src/lib/components/moveRenameManager.ts
+++ b/frontend/src/lib/components/moveRenameManager.ts
@@ -1,7 +1,8 @@
-import { AppService, FlowService, ScriptService } from '$lib/gen'
+import { AppService, FlowService, ResourceService, ScriptService } from '$lib/gen'
+import { agentEditorRefusal } from './flows/agentResourceUtils'
 import { invalidateWorkspacePaths } from './PathNameAutocomplete.svelte'
 
-type ItemKind = 'flow' | 'script' | 'app'
+type ItemKind = 'flow' | 'script' | 'app' | 'agent'
 
 /**
  * Check whether a flow uses on_behalf_of_email.
@@ -71,6 +72,24 @@ export async function updateItemPathAndSummary(opts: {
 				skip_draft_deletion: true
 			}
 		})
+	} else if (kind === 'agent') {
+		// An agent is a resource, and its summary is the resource's description. The read before
+		// the write is the same one the agent editor does: an update carries no resource type, so
+		// a path deleted and recreated as something else in the meantime would otherwise take an
+		// agent's config.
+		const current = await ResourceService.getResource({ workspace, path: initialPath })
+		const refused = agentEditorRefusal(initialPath, current.resource_type)
+		if (refused) {
+			throw new Error(refused)
+		}
+		// Only what this popover edits: the backend sets a column per field it is given, so the
+		// agent's own config, its type and `ws_specific` are left where they are rather than read
+		// here and written back over whatever changed in between.
+		await ResourceService.updateResource({
+			workspace,
+			path: initialPath,
+			requestBody: { path: newPath, description: newSummary, labels }
+		})
 	} else if (kind === 'app') {
 		await AppService.updateApp({
 			workspace,
diff --git a/frontend/src/lib/components/operatingWorkspace.svelte.ts b/frontend/src/lib/components/operatingWorkspace.svelte.ts
index 93a7f2c0de..70f1c63c1c 100644
--- a/frontend/src/lib/components/operatingWorkspace.svelte.ts
+++ b/frontend/src/lib/components/operatingWorkspace.svelte.ts
@@ -22,6 +22,14 @@ export function setOperatingWorkspace(resolve: () => string | undefined): void {
 	setContext(KEY, outer ? () => resolve() ?? outer() : resolve)
 }
 
+/** This subtree's operating workspace as an entry for a `ContextBridge` contexts map. A snippet
+ * handed to the page header's band renders outside the subtree that declared the workspace, so
+ * without this it would quietly act on the navigation workspace instead. Reads context: call
+ * during component initialisation. */
+export function operatingWorkspaceContextEntry(): [any, any] {
+	return [KEY, getContext(KEY)]
+}
+
 /** The workspace this component acts on, as a store. Reads context: call during component
  * initialisation. Falls back to the navigation workspace where no host set one, or where the
  * host's resolves to nothing. */
diff --git a/frontend/src/lib/components/pageHeaderRegistry.svelte.ts b/frontend/src/lib/components/pageHeaderRegistry.svelte.ts
new file mode 100644
index 0000000000..bd30855e15
--- /dev/null
+++ b/frontend/src/lib/components/pageHeaderRegistry.svelte.ts
@@ -0,0 +1,188 @@
+import type { Snippet } from 'svelte'
+import type { WorkspaceItemKind } from './workspacePicker'
+
+/** An item the page is working on: the breadcrumb walks its path and ends with its summary. */
+export type PageHeaderItem = {
+	/** Absent for an item the picker does not file under a kind — an agent's detail page. The
+	 *  breadcrumb then names the item without claiming it is one of the three. */
+	kind?: WorkspaceItemKind
+	/** Shown whole. Clicking it opens whatever the page hangs off it with `pathTrigger`, and copies
+	 *  the path where there is none. */
+	path: string | undefined
+	/** Wraps the band's own path segment in whatever the page wants behind it — its rename
+	 *  popover, anchored there rather than beside the summary, so the editor opens under the half
+	 *  of the name that was clicked. The band passes the path as it renders it and the classes its
+	 *  own segment wears, so the page's control keeps the breadcrumb's look rather than inventing
+	 *  one. Without this the segment copies the path on click. */
+	pathTrigger?: Snippet<[Snippet, string]>
+	summary?: string
+	/** Rendered in place of the plain summary, for a page whose summary is itself a control —
+	 *  a detail page's rename-and-labels popover, an editor's editable title. */
+	summaryContent?: Snippet
+}
+
+/** A page with no item of its own, such as a list: the breadcrumb is the section alone. */
+export type PageHeaderSection = {
+	label: string
+	/** The page the section belongs to, when the section is one pane of it — a settings page's
+	 *  active tab. Drawn as a lead segment before `label`. */
+	parent?: string
+	/** Rendered in place of `label` when the name is itself a control, such as an editable title. */
+	content?: Snippet
+	/** Scopes the segment's picker, when the section maps to a kind of item. */
+	kind?: WorkspaceItemKind
+}
+
+export type PageHeaderContent = {
+	item?: PageHeaderItem
+	section?: PageHeaderSection
+	/** Rendered at the right end of the bar — the page's own buttons. */
+	actions?: Snippet
+	/** Orders these buttons among the other registrations', ascending; registration order breaks a
+	 *  tie. For a menu that must stay at the far end however many pages register before it. */
+	actionsOrder?: number
+	/** These actions can give width back under pressure, so the bar lets their box shrink on a
+	 *  phone. Two ways to earn it: a control that is narrower when it has to be (the Runs filter
+	 *  row, whose search field yields), or a set that scrolls inside its own box (the app and
+	 *  pipeline editors, whose rows are too wide for any bar). Without it the box holds its content
+	 *  width, because squeezing a plain row of buttons only pushes them out of the bar. */
+	actionsFlexible?: boolean
+	/** These actions are not a row of buttons at the far end but a surface of their own, running
+	 *  from the breadcrumb to the bar's right edge: a session in full screen, whose tab strip and
+	 *  controls share one shape that opens into the page below. The bar gives up its right padding
+	 *  to it, since the surface is what meets the edge. */
+	actionsFill?: boolean
+	/** Rendered right after the page's name in the breadcrumb: a mark that belongs to the name,
+	 *  like a documentation tooltip, or a control that acts on the thing named — an app's Edit,
+	 *  which at the far end of the bar would be a journey away from what it edits. */
+	afterName?: Snippet
+	/** The workspace this page acts on, when it is not the one the app is pointed at — a session
+	 *  running in a fork. The breadcrumb then names that workspace, and its fork part shows only
+	 *  when it really is a fork. */
+	actingWorkspaceId?: string
+	/** Width in px, at the right of the viewport, that this page owns from the top down — a
+	 *  session's side panel. The band stops there instead of running over it, and the band floats
+	 *  above the page rather than pushing it down, so that column starts at the top. */
+	barRightInset?: number
+	/** The bottom edge under the bar, which the bar owns so a page cannot draw a second one.
+	 *  `onScroll` (the default) shows it only while something is passing under the bar — at the top
+	 *  of a list there is nothing to divide. `always` is for a page whose content starts right
+	 *  under the bar and needs the division at rest: an editor, a detail page, a settings pane.
+	 *  `none` is for a page that genuinely draws its own first line, such as the script editor's
+	 *  toolbar or the flow editor's canvas. */
+	separator?: 'onScroll' | 'always' | 'none'
+	/** Contexts this registration's snippets look up — its actions, what it hangs after the name,
+	 *  and its summary. They all render under the header rather than under the page that wrote
+	 *  them, so anything the page's tree provides has to travel with them. */
+	contexts?: Map<any, any>
+}
+
+// The bar belongs to the root layout and is always on screen; a route page fills its breadcrumb
+// and actions by registering here.
+//
+// A registration is a getter, not a snapshot: the layout calls it while rendering, so a path or
+// summary the page edits reaches the bar through the layout's own dependency tracking, with no
+// effect keeping two copies in step.
+//
+// Registrations stack, and what the bar shows is their merge (see `content`). Pages register on
+// mount, so the first entry is the outermost one — an editor nested in a session pane or a drawer
+// is asked to register nothing.
+let entries = $state<{ id: number; get: () => PageHeaderContent }[]>([])
+let nextId = 0
+
+/**
+ * Below this bar width a page keeps one button — the thing the page is for — and folds the rest
+ * into the menu it already shows when compact. A phone in portrait is ~390px of bar and a tablet
+ * in portrait ~720; the breadcrumb with its workspace disc takes ~150 of either, which is why the
+ * line sits above the tablet rather than between the two.
+ */
+export const PHONE_BAR = 800
+
+/** The bar's height, and the padding a page owes the band when the band floats over it rather than
+ *  sitting in the flow (see `barRightInset`). They are one measurement in two forms: raise one and
+ *  the other has to follow, or the page's own content disappears under the bar. Written as literal
+ *  class names so Tailwind sees them. */
+export const BAR_HEIGHT = 'h-12'
+export const BAR_TOP_PAD = 'pt-12'
+/** The same height in px, for the places that animate to the bar's bottom edge rather than
+ *  standing under it — a transition's `css` and a measurement's fallback take a number. */
+export const BAR_HEIGHT_PX = 48
+
+// The bar's own width, written by the bar and read by the pages that fill it. A page's buttons
+// share that row with the breadcrumb, so it is the width they crowd against — not the window's,
+// which the sidebar and a page's side panel both take from.
+let barWidth = $state(0)
+
+/**
+ * One registration's content, or undefined while it cannot answer.
+ *
+ * An entry is a getter closing over another component's props, evaluated here, in a tree of its
+ * own. Nothing orders a parent clearing those props against the child's teardown: a route that
+ * drops the `{#if}` around an editor and the value it binds into it does both in one flush, and
+ * this derived re-runs on the same flush, before the editor's own cleanup releases its entry. The
+ * entry has nothing to say in that window, which is not the same as the page having no header —
+ * so it is skipped, and whatever registered before it still stands.
+ */
+function read(e: { get: () => PageHeaderContent }): PageHeaderContent | undefined {
+	try {
+		return e.get()
+	} catch {
+		return undefined
+	}
+}
+
+export const pageHeader = {
+	/**
+	 * The registrations merged, later ones winning field by field: a route sets the frame (where
+	 * the bar goes) and something nested in it — the active session, say — fills the breadcrumb
+	 * and the actions.
+	 */
+	get content(): PageHeaderContent | undefined {
+		if (entries.length === 0) return undefined
+		const merged: PageHeaderContent = {}
+		for (const e of entries) {
+			const c = read(e)
+			if (!c) continue
+			if (c.item !== undefined) merged.item = c.item
+			if (c.section !== undefined) merged.section = c.section
+			if (c.afterName !== undefined) merged.afterName = c.afterName
+			if (c.contexts !== undefined) merged.contexts = c.contexts
+			if (c.actingWorkspaceId !== undefined) merged.actingWorkspaceId = c.actingWorkspaceId
+			if (c.barRightInset !== undefined) merged.barRightInset = c.barRightInset
+			if (c.actionsFlexible !== undefined) merged.actionsFlexible = c.actionsFlexible
+			if (c.actionsFill !== undefined) merged.actionsFill = c.actionsFill
+			if (c.separator !== undefined) merged.separator = c.separator
+		}
+		return merged
+	},
+	/**
+	 * Every registration's actions, in registration order: a page and something inside it can both
+	 * put buttons in the band, and each renders with the contexts its own registration named.
+	 */
+	get actions(): { render: Snippet; contexts?: Map<any, any> }[] {
+		return entries
+			.flatMap((e, i) => {
+				const c = read(e)
+				return c?.actions
+					? [{ render: c.actions, contexts: c.contexts, order: c.actionsOrder ?? 0, i }]
+					: []
+			})
+			.sort((a, b) => a.order - b.order || a.i - b.i)
+	},
+	/** Width of the bar in px, or 0 before it has been measured. */
+	get barWidth(): number {
+		return barWidth
+	},
+	setBarWidth(w: number) {
+		barWidth = w
+	},
+	/** Registers on mount and returns the id to release on destroy. */
+	register(get: () => PageHeaderContent): number {
+		const id = nextId++
+		entries = [...entries, { id, get }]
+		return id
+	},
+	release(id: number) {
+		entries = entries.filter((e) => e.id !== id)
+	}
+}
diff --git a/frontend/src/lib/components/pageHeaderRegistry.test.ts b/frontend/src/lib/components/pageHeaderRegistry.test.ts
new file mode 100644
index 0000000000..035eabb60e
--- /dev/null
+++ b/frontend/src/lib/components/pageHeaderRegistry.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it, afterEach } from 'vitest'
+import { pageHeader, type PageHeaderContent } from './pageHeaderRegistry.svelte'
+import type { Snippet } from 'svelte'
+
+// The merge rule every registration site depends on: a page sets the frame and something nested
+// in it fills the breadcrumb, so whether a component registers at all decides whose name the band
+// shows. A viewer that registered wherever it was mounted renamed the band of the session hosting
+// it.
+const snippet = (name: string) => name as unknown as Snippet
+
+const ids: number[] = []
+function register(c: PageHeaderContent) {
+	ids.push(pageHeader.register(() => c))
+}
+afterEach(() => {
+	while (ids.length) pageHeader.release(ids.pop()!)
+})
+
+describe('pageHeader', () => {
+	it('is empty with nothing registered', () => {
+		expect(pageHeader.content).toBeUndefined()
+	})
+
+	it('lets a later registration win field by field', () => {
+		register({ section: { label: 'Sessions' }, barRightInset: 400 })
+		register({ item: { path: 'u/admin/app' } })
+		expect(pageHeader.content).toEqual({
+			section: { label: 'Sessions' },
+			item: { path: 'u/admin/app' },
+			barRightInset: 400
+		})
+	})
+
+	it('gives the fields of a released registration back', () => {
+		register({ section: { label: 'Sessions' } })
+		register({ item: { path: 'u/admin/app' } })
+		pageHeader.release(ids.pop()!)
+		expect(pageHeader.content?.item).toBeUndefined()
+		expect(pageHeader.content?.section).toEqual({ label: 'Sessions' })
+	})
+
+	it('orders actions by actionsOrder, then by registration', () => {
+		register({ actions: snippet('page'), actionsOrder: 10 })
+		register({ actions: snippet('nested') })
+		register({ actions: snippet('alsoNested') })
+		expect(pageHeader.actions.map((a) => a.render)).toEqual(['nested', 'alsoNested', 'page'])
+	})
+
+	it('carries the contexts of each registration with its actions', () => {
+		const pageContexts = new Map([['TriggerContext', 1]])
+		register({ actions: snippet('page'), contexts: pageContexts })
+		register({ actions: snippet('nested') })
+		expect(pageHeader.actions.map((a) => a.contexts)).toEqual([pageContexts, undefined])
+	})
+})
diff --git a/frontend/src/lib/components/raw_apps/RawAppBackgroundRunner.svelte b/frontend/src/lib/components/raw_apps/RawAppBackgroundRunner.svelte
index c3eadc1f68..9f675664b1 100644
--- a/frontend/src/lib/components/raw_apps/RawAppBackgroundRunner.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppBackgroundRunner.svelte
@@ -52,6 +52,11 @@
 	// Job ids launched by this app instance — see `gateJobIds`.
 	const launchedJobs = new Set<string>()
 
+	/** For a host that loads this component after the bundle may already have sent requests. */
+	export function handleMessage(event: MessageEvent) {
+		return listener(event)
+	}
+
 	let listener = async (event) => {
 		// Only accept messages from the bundle iframe (opaque origin) or the
 		// detached preview window we opened, so other frames/extensions can't
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
index 8a0655d70e..f708b97efe 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
@@ -50,7 +50,14 @@
 	import { createAppSelectedContext, type AppCodeSelectionElement } from '../copilot/chat/context'
 	import { captureScale, MAX_IMAGE_EDGE } from '../copilot/chat/imageUtils'
 	import { rawAppLintStore } from './lintStore'
-	import { dbSchemas } from '$lib/stores'
+	import { dbSchemas, userStore } from '$lib/stores'
+	import RawAppSdkConsent from './RawAppSdkConsent.svelte'
+	import {
+		hasStoredSdkConsent,
+		movePreviewSdkConsent,
+		sdkConsentCovers,
+		storeSdkConsent
+	} from './sdkScopes'
 	import {
 		MousePointerSquareDashed,
 		RefreshCw,
@@ -147,6 +154,8 @@
 		 *  it as `draft_path` so the home row shows the friendly name, not `draft_{uuid}`. */
 		pendingDraftPath?: string | undefined
 		// Threaded to the AutosaveIndicator's "Reset to deployed" button.
+		/** `Exit & see details`: see RawAppEditorHeader. */
+		onDetails?: (e: { path: string }) => void
 		onResetToDeployed?: () => void | Promise<void>
 		/** The app_version the draft forked from, for the deploy-time "new version
 		 *  deployed" guard: deploying is refused with a confirmation while it is not
@@ -191,6 +200,8 @@
 		// EditorHeader's path/breadcrumb row dropped (summary only). Used by the
 		// session preview to save vertical room.
 		condensedHeader?: boolean
+		/** True for the route's own editor: its top bar becomes the page header. */
+		ownsPageHeader?: boolean
 	}
 
 	let {
@@ -214,6 +225,7 @@
 		autosavePath = undefined,
 		defaultSplitWithPreview = true,
 		pendingDraftPath = $bindable(undefined),
+		onDetails,
 		onResetToDeployed,
 		loadedFromDraft = false,
 		othersDraftsCount = 0,
@@ -230,6 +242,7 @@
 		onRestore,
 		onSavedNewAppPath,
 		condensedHeader = false,
+		ownsPageHeader = false,
 		version = undefined,
 		onTakeLatest = undefined,
 		draftBaseVersion = undefined
@@ -414,6 +427,9 @@
 	// carry our origin, so they travel wrapped: listeners that trust a same-origin
 	// message must not see the isolated app's as their own.
 	let previewControllerUrl: string | undefined = undefined
+	// Editor-to-controller only, never relayed to the app: the consent prompt lives in
+	// the editor, so the pop-out says why it is blank.
+	const PREVIEW_NOTICE = 'wm:previewNotice'
 	onDestroy(() => {
 		if (previewControllerUrl) URL.revokeObjectURL(previewControllerUrl)
 	})
@@ -423,14 +439,19 @@
 				[
 					`<!DOCTYPE html><html><head><meta charset="utf-8"><title>App preview</title>
 <link rel="icon" href="${window.location.origin}/logo.svg">
-<style>html,body{margin:0;height:100%}iframe{display:block;border:0;width:100%;height:100%}</style>
+<style>html,body{margin:0;height:100%}iframe{display:block;border:0;width:100%;height:100%}
+#n{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:16px;text-align:center;font:14px system-ui,sans-serif;color-scheme:light dark;background:Canvas;color:CanvasText}#n[hidden]{display:none}</style>
 <script>
 addEventListener('message', function (e) {
   var frame = document.querySelector('iframe').contentWindow
   if (e.source === frame && opener) opener.postMessage({ type: '${RAW_APP_PREVIEW_RELAY}', data: e.data }, location.origin, e.ports)
-  else if (e.source === opener) frame.postMessage(e.data, '*')
+  else if (e.source === opener && e.data && e.data.type === '${PREVIEW_NOTICE}') {
+    var n = document.getElementById('n')
+    n.textContent = e.data.text || ''
+    n.hidden = !e.data.text
+  } else if (e.source === opener) frame.postMessage(e.data, '*')
 })
-<\/script></head><body><iframe src="${window.location.origin}${sandboxedShellUrl}" sandbox="${RAW_APP_SANDBOX_FLAGS}" referrerpolicy="no-referrer"></iframe></body></html>`
+<\/script></head><body><div id="n" hidden></div><iframe src="${window.location.origin}${sandboxedShellUrl}" sandbox="${RAW_APP_SANDBOX_FLAGS}" referrerpolicy="no-referrer"></iframe></body></html>`
 				],
 				{ type: 'text/html' }
 			)
@@ -1636,15 +1657,22 @@ addEventListener('message', function (e) {
 	// omitting it would leave an old token in place.
 	type PreviewSdk = { token: string; baseUrl: string; workspace: string }
 	let previewSdk: PreviewSdk | undefined = undefined
-	// Identifies the request whose answer is still wanted. Toggling scopes starts a
-	// new mint while an older one is in flight, and an out-of-order answer would
-	// otherwise hand the preview the wrong scope set — or restore a token after all
-	// scopes were removed.
+	// The setup the preview last started from; an unchanged one is not redone.
 	let previewSdkKey: string | undefined = undefined
+	// Bumped on every new setup: only the newest mint's answer is used. Toggling scopes
+	// starts a new mint while an older one is in flight, and toggling back recreates the
+	// same key, so a key check alone would let an out-of-order answer hand the preview
+	// the wrong scope set, restore a removed token, or start a preview since declined.
+	let previewSdkGeneration = 0
 	// Holds the build back between dropping a credential and settling its
 	// replacement, so the app mounts once — with the final credential — instead of
 	// once tokenless and again tokenful, running mount-time side effects twice.
 	let previewSdkPending = $state(false)
+	// Holds the app back (with `previewSdkPending`) until the viewer answers.
+	let sdkPrompt = $state<{ scopes: string[]; ws: string; declined: boolean } | undefined>(undefined)
+	// What Continue granted in this editor session, kept the way a loaded deployed
+	// app keeps its token: only a scope beyond it asks again.
+	let sessionSdkConsent: { ws: string; scopes: string[] } | undefined = undefined
 
 	/** Discard the running app. The shell resets the DOM but keeps the JavaScript
 	 * realm, so only a reload drops the old bundle's timers, listeners and the
@@ -1690,6 +1718,7 @@ addEventListener('message', function (e) {
 		const key = `${sandboxed}|${ws ?? ''}|${scopes.join(',')}`
 		if (key === previewSdkKey) return
 		previewSdkKey = key
+		previewSdkGeneration++
 		// Drop the old credential before asking for its replacement, never after:
 		// a mint is asynchronous, and until it answers the running preview — and
 		// any build fed meanwhile — would keep scopes the policy just removed, or
@@ -1697,24 +1726,68 @@ addEventListener('message', function (e) {
 		const willMint = scopes.length > 0 && !!ws
 		previewSdkPending = willMint
 		previewSdk = undefined
+		sdkPrompt = undefined
 		restartPreviewRealm()
-		if (willMint) mintPreviewSdkToken(scopes, ws, key)
+		if (!willMint) return
+		// Ask before the app's code runs, as the deployed app does: the token acts
+		// as whoever has the editor open.
+		const granted =
+			(sessionSdkConsent?.ws === ws && sdkConsentCovers(sessionSdkConsent.scopes, scopes)) ||
+			untrack(() => hasStoredSdkConsent($userStore?.email ?? '', ws, path, scopes, true))
+		if (granted) {
+			mintPreviewSdkToken(scopes, ws)
+		} else {
+			sdkPrompt = { scopes, ws, declined: false }
+			if (externalPreviewWindow && !externalPreviewWindow.closed) {
+				untrack(() => select({ kind: 'preview' }))
+			}
+		}
 	})
 
-	async function mintPreviewSdkToken(scopes: string[], ws: string, key: string) {
+	$effect(() => {
+		sdkPrompt?.declined
+		untrack(syncExternalPreviewNotice)
+	})
+
+	function syncExternalPreviewNotice() {
+		if (!sandboxed || !externalPreviewWindow || externalPreviewWindow.closed) return
+		const text = !sdkPrompt
+			? ''
+			: sdkPrompt.declined
+				? 'The preview is blocked until you grant the permissions this app declares. You can review them in the editor window.'
+				: 'This app is waiting for you to approve its permissions in the editor window.'
+		externalPreviewWindow.postMessage({ type: PREVIEW_NOTICE, text }, window.location.origin)
+	}
+
+	async function onSdkConsentContinue(dontAskAgain: boolean) {
+		if (!sdkPrompt) return
+		const { scopes, ws } = sdkPrompt
+		sdkPrompt = undefined
+		// Recorded on the click, as the deployed app does, so a scope edit reverted while
+		// this mint is in flight is still approved and does not ask again.
+		sessionSdkConsent = { ws, scopes }
+		if (!(await mintPreviewSdkToken(scopes, ws))) return
+		const viewer = $userStore?.email
+		if (dontAskAgain && viewer) storeSdkConsent(viewer, ws, path, scopes, true)
+	}
+
+	async function mintPreviewSdkToken(scopes: string[], ws: string) {
+		const generation = previewSdkGeneration
 		try {
 			const token = await AppService.mintPreviewSdkToken({
 				workspace: ws,
 				requestBody: { path, scopes }
 			})
-			if (key !== previewSdkKey) return
+			if (generation !== previewSdkGeneration) return false
 			applyPreviewSdk({ token, baseUrl: window.location.origin, workspace: ws })
+			return true
 		} catch (e) {
 			// Already tokenless — the effect cleared the env before calling us — so
 			// this only releases the build. The key stays set, so a failed mint is not
 			// retried until the scopes or workspace actually change.
 			console.warn('Could not mint a preview SDK token', e)
-			if (key === previewSdkKey) applyPreviewSdk(undefined)
+			if (generation === previewSdkGeneration) applyPreviewSdk(undefined)
+			return false
 		}
 	}
 
@@ -1762,16 +1835,19 @@ addEventListener('message', function (e) {
 	// `syncExternalPreview` alone (the theme hasn't changed).
 	function feedExternalPreview() {
 		postToExternalPreview({ type: 'setDarkMode', dark: darkMode, variant: darkVariant })
+		syncExternalPreviewNotice()
 		syncExternalPreview()
 	}
 
-	onDestroy(() => {
-		// Don't leave a detached preview behind when the editor unmounts: it
-		// would stop receiving builds and, once refreshed, has no opener to
-		// re-feed it — a permanently blank orphan.
+	// Don't leave a detached preview behind when the editor goes away, by
+	// unmounting or by its tab reloading or closing (`pagehide`, which skips
+	// `onDestroy`): it would stop receiving builds, and its document is a blob
+	// URL owned by this page, so refreshing it gives "not found".
+	function closeExternalPreview() {
 		if (externalPreviewWindow && !externalPreviewWindow.closed) externalPreviewWindow.close()
 		externalPreviewWindow = null
-	})
+	}
+	onDestroy(closeExternalPreview)
 
 	function openExternalPreview() {
 		// Reuse an already-open window instead of spawning duplicates.
@@ -1863,13 +1939,20 @@ addEventListener('message', function (e) {
 	const requestRuntimeLogs: RawAppRuntimeLogRequester = async (limit) => {
 		await buildTracker.wait()
 		if (editorDestroyed) {
-			return { entries: undefined, buildError: undefined, buildPending: false, buildLogs: '' }
+			return {
+				entries: undefined,
+				buildError: undefined,
+				buildPending: false,
+				buildLogs: '',
+				sdkConsentPending: false
+			}
 		}
 		return {
 			entries: await requestPreviewConsoleLogs(limit),
 			buildError,
 			buildPending: buildTracker.pending,
-			buildLogs: logs
+			buildLogs: logs,
+			sdkConsentPending: sdkPrompt !== undefined
 		}
 	}
 
@@ -2431,7 +2514,7 @@ addEventListener('message', function (e) {
 	}
 </script>
 
-<svelte:window onmessage={listener} onkeydown={handleKeydown} />
+<svelte:window onmessage={listener} onkeydown={handleKeydown} onpagehide={closeExternalPreview} />
 <DarkModeObserver
 	bind:darkMode
 	on:change={() => {
@@ -2467,7 +2550,12 @@ addEventListener('message', function (e) {
 		{onTakeLatest}
 		{draftBaseVersion}
 		{onRestore}
-		{onSavedNewAppPath}
+		onSavedNewAppPath={(newAppPath) => {
+			if (opWorkspace && $userStore?.email) {
+				movePreviewSdkConsent($userStore.email, opWorkspace, path, newAppPath)
+			}
+			onSavedNewAppPath?.(newAppPath)
+		}}
 		{policy}
 		{diffDrawer}
 		{newApp}
@@ -2484,6 +2572,7 @@ addEventListener('message', function (e) {
 		{getBundle}
 		{onNavigate}
 		{onDeploy}
+		{onDetails}
 		{onResetToDeployed}
 		{loadedFromDraft}
 		{othersDraftsCount}
@@ -2496,6 +2585,7 @@ addEventListener('message', function (e) {
 		sidebarCollapsed={sidebarCollapsed.val}
 		onToggleSidebar={() => (sidebarCollapsed.val = !sidebarCollapsed.val)}
 		{condensedHeader}
+		{ownsPageHeader}
 	/>
 
 	<RawAppYamlEditor
@@ -2777,7 +2867,32 @@ addEventListener('message', function (e) {
 										></iframe>
 									{/key}
 								{/if}
-								{#if buildError}
+								{#if sdkPrompt}
+									<!-- top-10 leaves the tab bar usable. -->
+									<div class="absolute top-10 inset-x-0 bottom-0 z-30 bg-surface overflow-auto">
+										{#if sdkPrompt.declined}
+											<div class="px-4 mt-20 max-w-xl mx-auto flex flex-col items-start gap-4">
+												<p class="text-sm text-secondary">
+													The preview is blocked until you grant the permissions this app declares.
+												</p>
+												<Button
+													variant="default"
+													unifiedSize="md"
+													onclick={() => sdkPrompt && (sdkPrompt.declined = false)}
+												>
+													Review permissions
+												</Button>
+											</div>
+										{:else}
+											<RawAppSdkConsent
+												scopes={sdkPrompt.scopes}
+												declineLabel="Decline"
+												onContinue={onSdkConsentContinue}
+												onDecline={() => sdkPrompt && (sdkPrompt.declined = true)}
+											/>
+										{/if}
+									</div>
+								{:else if buildError}
 									<!-- top-12 clears the tab bar; `before:bg-surface` backs the
 									     Alert's translucent red; `isolate` pins the pseudo's stacking context. -->
 									<div class="absolute top-12 left-2 right-2 z-20 isolate" role="alert">
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
index afb8e3fa89..bea1d1ea33 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
@@ -3,7 +3,7 @@
 	import { base } from '$lib/base'
 	import RawAppRecordSession from '$lib/components/workspaceSettings/RawAppRecordSession.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
-	import { isMac, userPathPrefix } from '$lib/utils'
+	import { isMac, userPathPrefix, emptyString } from '$lib/utils'
 	import { editPathFor } from '$lib/components/workspacePicker'
 	import { invalidateWorkspacePaths } from '$lib/components/PathNameAutocomplete.svelte'
 
@@ -28,7 +28,7 @@
 		Undo,
 		WandSparkles
 	} from 'lucide-svelte'
-	import { onDestroy, untrack } from 'svelte'
+	import { onDestroy, untrack, type Snippet } from 'svelte'
 	import { orderedJsonStringify, type Value, replaceFalseWithUndefined } from '../../utils'
 	import { random_adj } from '$lib/components/random_positive_adjetive'
 
@@ -76,9 +76,13 @@
 	import { editInForkAllowed, editInForkLabel, openEditInFork } from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
 	import {
+		operatingWorkspaceContextEntry,
 		useOperatingUser,
 		useOperatingWorkspace
 	} from '$lib/components/operatingWorkspace.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
@@ -153,6 +157,8 @@
 		 * EditorHeader's path/breadcrumb row dropped (summary only). Used by the
 		 * session preview to save vertical room. */
 		condensedHeader?: boolean
+		/** True for the route's own editor: its top bar becomes the page header. */
+		ownsPageHeader?: boolean
 		onNavigate?: (item: import('$lib/components/workspacePicker').WorkspaceItem) => void
 		liveEditorDraftStoragePath?: string
 		/** Indicator-only overrides for the sessions preview: the AutosaveIndicator
@@ -180,6 +186,9 @@
 		pendingDraftPath?: string | undefined
 		// Threaded to the `AutosaveIndicator` popover so its "Reset to
 		// deployed" button can do the same thing the load-time toast offers.
+		/** `Exit & see details`: leaves the editor for the app's deployed page. A session hosts that
+		 *  page itself, so it flips the tab there rather than navigating out of the session. */
+		onDetails?: (e: { path: string }) => void
 		onResetToDeployed?: () => void | Promise<void>
 		// See ScriptBuilderProps — same semantics for the raw-app editor's
 		// indicator.
@@ -198,7 +207,7 @@
 
 	let {
 		summary = $bindable(),
-		policy = $bindable(),
+		policy,
 		diffDrawer = undefined,
 		savedApp = $bindable(undefined),
 		version = $bindable(undefined),
@@ -223,12 +232,14 @@
 		sidebarCollapsed = false,
 		onToggleSidebar = undefined,
 		condensedHeader = false,
+		ownsPageHeader = false,
 		onNavigate = undefined,
 		liveEditorDraftStoragePath = undefined,
 		autosaveWorkspace = undefined,
 		autosavePath = undefined,
 		onDeploy = undefined,
 		pendingDraftPath = $bindable(undefined),
+		onDetails,
 		onResetToDeployed,
 		loadedFromDraft = false,
 		othersDraftsCount = 0,
@@ -308,18 +319,45 @@
 
 	// Top-bar responsive collapse — container width, not viewport.
 	let topbarWidth = $state(0)
-	const compactTopbar = $derived(topbarWidth > 0 && topbarWidth < 720)
+	// In the page header the buttons share the row with the breadcrumb, so they collapse sooner:
+	// the trail and the summary take ~430px of the same row, and the whole group — the menu, Diff,
+	// Jobs, Export, AI and Deploy — is ~560px.
+	const compactBelow = $derived(ownsPageHeader ? 1350 : 720)
+	const compactTopbar = $derived.by(() => {
+		const w = ownsPageHeader ? pageHeader.barWidth : topbarWidth
+		return w > 0 && w < compactBelow
+	})
+	// A phone's bar keeps the trail, the file sidebar's toggle, Diff and Deploy. AI stands down —
+	// the sidebar's own Ask AI is the way in at that width — while Jobs and the export are already
+	// in the menu, Jobs from `compactTopbar` (true at any phone width) and the export always.
+	const phoneTopbar = $derived(
+		ownsPageHeader && pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR
+	)
 
 	// Top-bar button size + bar height. Condensed (session preview) uses the
 	// smallest well-supported unified size (`sm`) so the bar is thinner.
-	const headerBtnSize = $derived(condensedHeader ? 'sm' : 'md')
+	// In the page header the buttons ride a 44px band, the same size the condensed session-pane
+	// header uses.
+	const headerBtnSize = $derived(condensedHeader || ownsPageHeader ? 'sm' : 'md')
+
+	/** Held by the rename popover while it is open; the band's trail reads it so the path does not
+	 *  reflow under the pointer as the user types. */
+	let pathSnapshot = $state<string | undefined>(undefined)
+
+	// The actions render under the band, outside the subtree RawAppEditor declared the operating
+	// workspace in, so it has to travel with them: OpenInSessionButton asks who the acting user is.
+	const headerContexts = new Map<any, any>([operatingWorkspaceContextEntry()])
 
 	function closeSaveDrawer() {
 		saveDrawerOpen = false
 	}
 
-	async function computeTriggerables() {
-		policy = await updateRawAppPolicy(runnables, policy)
+	// Returns a copy: `policy` is the editor's own object, which the Deploy panel's
+	// instant toggles mutate in place. Reassigning it would detach the panel from the
+	// editor, so later toggles would never reach the preview. After a successful save,
+	// copy only `triggerables_v2` back so the editor's value matches what was deployed.
+	function policyWithTriggerables() {
+		return updateRawAppPolicy(runnables, policy)
 	}
 
 	async function createApp(path: string) {
@@ -330,9 +368,9 @@
 		if (!policy.execution_mode) {
 			policy.execution_mode = 'publisher'
 		}
-		await computeTriggerables()
 		try {
 			const { js, css } = await getBundle()
+			const deployedPolicy = await policyWithTriggerables()
 			await AppService.createAppRaw({
 				workspace: opWorkspace!,
 				formData: {
@@ -340,7 +378,7 @@
 						value: app,
 						path,
 						summary: summary,
-						policy,
+						policy: deployedPolicy,
 						deployment_message: deploymentMsg,
 						custom_path: customPath,
 						preserve_on_behalf_of: preserveOnBehalfOf || undefined,
@@ -350,6 +388,7 @@
 					css
 				}
 			})
+			policy.triggerables_v2 = deployedPolicy.triggerables_v2
 			// New path now exists server-side — drop the autocomplete cache so
 			// it shows up immediately instead of after the 60s TTL.
 			invalidateWorkspacePaths(opWorkspace!)
@@ -357,7 +396,7 @@
 				summary: summary,
 				value: structuredClone(stateSnapshot(app)),
 				path: path,
-				policy: policy,
+				policy: deployedPolicy,
 				custom_path: customPath,
 				labels: $state.snapshot(labels)
 			}
@@ -555,10 +594,10 @@
 			return
 		}
 		const { js, css } = await getBundle()
-		await computeTriggerables()
 		if (!policy.execution_mode) {
 			policy.execution_mode = 'publisher'
 		}
+		const deployedPolicy = await policyWithTriggerables()
 		const deployed = await AppService.updateAppRaw({
 			workspace: opWorkspace!,
 			path: appPath!,
@@ -566,7 +605,7 @@
 				app: {
 					value: app!,
 					summary: summary,
-					policy,
+					policy: deployedPolicy,
 					path: npath,
 					deployment_message: deploymentMsg,
 					preserve_on_behalf_of: preserveOnBehalfOf || undefined,
@@ -580,12 +619,13 @@
 				css
 			}
 		})
+		policy.triggerables_v2 = deployedPolicy.triggerables_v2
 		invalidateWorkspacePaths(opWorkspace!)
 		savedApp = {
 			summary: summary,
 			value: structuredClone(stateSnapshot(app)),
 			path: npath,
-			policy,
+			policy: deployedPolicy,
 			custom_path: customPath,
 			labels: $state.snapshot(labels)
 		}
@@ -621,12 +661,13 @@
 	}
 
 	async function setPublishState(message?: string) {
-		await computeTriggerables()
+		const nextPolicy = await policyWithTriggerables()
 		await AppService.updateApp({
 			workspace: opWorkspace!,
 			path: appPath,
-			requestBody: { policy }
+			requestBody: { policy: nextPolicy }
 		})
+		policy.triggerables_v2 = nextPolicy.triggerables_v2
 		if (message) {
 			sendUserToast(message)
 		} else if (policy.execution_mode == 'anonymous') {
@@ -903,121 +944,212 @@
 	errorByComponent={{}}
 />
 
-<div
-	bind:clientWidth={topbarWidth}
-	class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto shrink-0 {condensedHeader
-		? 'max-h-9 h-9'
-		: 'max-h-12 h-12'}"
->
-	<!-- Identity block: shrinks/truncates first so the cloud indicator and the
+{#if ownsPageHeader}
+	<!-- The editor's own top bar is the page header on this route: the app's path and summary are
+	     the breadcrumb's, and everything else the bar carried rides along as the header's actions.
+	     `separator="none"`: the splitpanes below draw their own top line, and the bar's edge would
+	     be a second one on top of it. -->
+	<PageHeaderContent
+		item={{
+			// The path being edited, not the stored one: a brand-new app is parked at a
+			// `draft_<uuid>` placeholder, and the trail would name that instead of the path Deploy
+			// will create — which is why `newEditedPath` refuses the placeholder. Frozen while the
+			// rename popover is open so the trail holds still as the user types.
+			kind: 'app',
+			path: pathSnapshot ?? (newEditedPath || appPath || newPath || undefined),
+			summaryContent: appSummary,
+			pathTrigger: rawAppPathTrigger
+		}}
+		actions={rawAppHeaderActions}
+		contexts={headerContexts}
+		separator="none"
+	/>
+{:else}
+	<div
+		bind:clientWidth={topbarWidth}
+		class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto shrink-0 {condensedHeader
+			? 'max-h-9 h-9'
+			: 'max-h-12 h-12'}"
+	>
+		<!-- Identity block: shrinks/truncates first so the cloud indicator and the
 	     action buttons stay visible. Without min-w-0 the breadcrumb + summary
 	     overflow this box on narrow widths and get overlapped by the (formerly
 	     un-pinned) action group, hiding the autosave cloud. -->
-	<div class="flex flex-row gap-2 items-center min-w-0">
-		{#if onToggleSidebar}
-			<Button
-				unifiedSize="sm"
-				variant="subtle"
-				iconOnly
-				startIcon={{ icon: sidebarCollapsed ? PanelLeft : PanelLeftClose }}
-				title={`${sidebarCollapsed ? 'Expand' : 'Collapse'} file sidebar (${isMac() ? '⌘' : 'Ctrl+'}B)`}
-				on:click={() => onToggleSidebar?.()}
-			/>
-		{/if}
-		<div class="min-w-0 overflow-hidden">
-			<EditorHeader
-				bind:summary
-				bind:path={newEditedPath}
-				savedPath={appPath || newPath || undefined}
-				kind="app"
-				raw_app
-				hidePath={condensedHeader}
-				workspaceId={autosaveWorkspace}
-				onNavigate={(item) => (onNavigate ? onNavigate(item) : goto(editPathFor(item)))}
-			/>
+		<div class="flex flex-row gap-2 items-center min-w-0">
+			{@render sidebarToggle()}
+			<div class="min-w-0 overflow-hidden">
+				<EditorHeader
+					bind:summary
+					bind:path={newEditedPath}
+					savedPath={appPath || newPath || undefined}
+					kind="app"
+					raw_app
+					hidePath={condensedHeader}
+					workspaceId={autosaveWorkspace}
+					onNavigate={(item) => (onNavigate ? onNavigate(item) : goto(editPathFor(item)))}
+				/>
+			</div>
+			{@render autosaveIndicator()}
 		</div>
-		{#if opWorkspace && indicatorPath !== undefined}
-			<AutosaveIndicator
-				workspace={opWorkspace}
-				itemKind="raw_app"
-				path={indicatorPath}
-				draftOnly={newApp}
-				{onResetToDeployed}
-				{loadedFromDraft}
-				{othersDraftsCount}
-				{onOpenOthersDrafts}
-			/>
-		{/if}
-	</div>
 
+		{@render awarenessMark()}
+		<div class="flex flex-row gap-2 justify-end items-center overflow-visible shrink-0">
+			{@render rawAppActions()}
+		</div>
+	</div>
+{/if}
+
+{#snippet sidebarToggle()}
+	{#if onToggleSidebar}
+		<Button
+			unifiedSize="sm"
+			variant="subtle"
+			iconOnly
+			startIcon={{ icon: sidebarCollapsed ? PanelLeft : PanelLeftClose }}
+			title={`${sidebarCollapsed ? 'Expand' : 'Collapse'} file sidebar (${isMac() ? '⌘' : 'Ctrl+'}B)`}
+			on:click={() => onToggleSidebar?.()}
+		/>
+	{/if}
+{/snippet}
+
+{#snippet autosaveIndicator()}
+	{#if opWorkspace && indicatorPath !== undefined}
+		<AutosaveIndicator
+			workspace={opWorkspace}
+			itemKind="raw_app"
+			path={indicatorPath}
+			draftOnly={newApp}
+			{onResetToDeployed}
+			{loadedFromDraft}
+			{othersDraftsCount}
+			{onOpenOthersDrafts}
+		/>
+	{/if}
+{/snippet}
+
+{#snippet awarenessMark()}
 	{#if $enterpriseLicense && appPath != '' && !inSessionPane}
 		<div class="shrink-0">
 			<Awareness />
 		</div>
 	{/if}
-	<div class="flex flex-row gap-2 justify-end items-center overflow-visible shrink-0">
-		<DropdownV2 items={moreItems} class="h-auto">
-			{#snippet buttonReplacement()}
-				<Button
-					nonCaptureEvent
-					unifiedSize={headerBtnSize}
-					variant="subtle"
-					startIcon={{ icon: EllipsisVertical }}
-					iconOnly
-				></Button>
-			{/snippet}
-		</DropdownV2>
+{/snippet}
 
-		<!-- A disabled <button> fires no pointer events, so a title/tooltip on it
+<!-- The summary's editor again, hung off the band's path segment so it opens under the path, with
+     the cursor in the path field. `bind:` cannot be spread, so the slots are written out twice;
+     both instances bind the same ones and only one is ever open. -->
+{#snippet rawAppPathTrigger(pathLabel: Snippet, triggerClass: string)}
+	<PathEditPopover
+		label={pathLabel}
+		{triggerClass}
+		focusField="path"
+		bind:summary
+		bind:path={newEditedPath}
+		bind:snapshotPath={pathSnapshot}
+		savedPath={appPath || undefined}
+		kind="app"
+		workspaceId={autosaveWorkspace}
+	/>
+{/snippet}
+
+{#snippet appSummary()}
+	<!-- Not edited in place: clicking the name opens the summary and the path together, so the band
+	     reads as a name rather than a form. `title` for one it truncates. -->
+	<div class="flex items-center gap-1 min-w-0">
+		{#snippet summaryText()}
+			<span
+				class="min-w-0 truncate text-xs {emptyString(summary)
+					? 'text-tertiary italic font-normal'
+					: 'font-medium text-emphasis'}"
+				title={summary}>{emptyString(summary) ? 'Add a summary...' : summary}</span
+			>
+		{/snippet}
+		<PathEditPopover
+			label={summaryText}
+			bind:summary
+			bind:path={newEditedPath}
+			bind:snapshotPath={pathSnapshot}
+			savedPath={appPath || undefined}
+			kind="app"
+			workspaceId={autosaveWorkspace}
+		/>
+	</div>
+{/snippet}
+
+{#snippet rawAppHeaderActions()}
+	<!-- The bar's own order kept: the file sidebar, how the draft is doing, who else is here, then
+	     what to do with the app. The sidebar's toggle is the only way back once it is folded — the
+	     collapsed sidebar renders nothing of its own — so it stays on the bar at every width. -->
+	{@render sidebarToggle()}
+	{@render autosaveIndicator()}
+	{@render awarenessMark()}
+	{@render rawAppActions()}
+{/snippet}
+
+{#snippet rawAppActions()}
+	<DropdownV2 items={moreItems} class="h-auto">
+		{#snippet buttonReplacement()}
+			<Button
+				nonCaptureEvent
+				unifiedSize={headerBtnSize}
+				variant="subtle"
+				startIcon={{ icon: EllipsisVertical }}
+				iconOnly
+			></Button>
+		{/snippet}
+	</DropdownV2>
+
+	<!-- A disabled <button> fires no pointer events, so a title/tooltip on it
 		     never shows on hover. pointer-events-none on the button lets the hover
 		     reach this titled wrapper instead. -->
-		<div
+	<div
+		title={newApp || savedApp?.no_deployed === true
+			? 'Deploy this app once to compare against the deployed version'
+			: 'Diff'}
+		class={!savedApp || newApp || savedApp?.no_deployed === true
+			? 'flex cursor-not-allowed'
+			: 'flex'}
+	>
+		<Button
+			variant="default"
+			unifiedSize={headerBtnSize}
+			on:click={() => openDiffDrawer()}
+			disabled={!savedApp || newApp || savedApp?.no_deployed === true}
+			btnClasses={!savedApp || newApp || savedApp?.no_deployed === true
+				? 'pointer-events-none'
+				: undefined}
+			iconOnly={compactTopbar}
 			title={newApp || savedApp?.no_deployed === true
 				? 'Deploy this app once to compare against the deployed version'
 				: 'Diff'}
-			class={!savedApp || newApp || savedApp?.no_deployed === true
-				? 'flex cursor-not-allowed'
-				: 'flex'}
+			startIcon={{ icon: DiffIcon }}
 		>
-			<Button
-				variant="default"
-				unifiedSize={headerBtnSize}
-				on:click={() => openDiffDrawer()}
-				disabled={!savedApp || newApp || savedApp?.no_deployed === true}
-				btnClasses={!savedApp || newApp || savedApp?.no_deployed === true
-					? 'pointer-events-none'
-					: undefined}
-				iconOnly={compactTopbar}
-				title={newApp || savedApp?.no_deployed === true
-					? 'Deploy this app once to compare against the deployed version'
-					: 'Diff'}
-				startIcon={{ icon: DiffIcon }}
-			>
-				Diff
-			</Button>
-		</div>
+			Diff
+		</Button>
+	</div>
 
-		<div class="{compactTopbar ? 'hidden' : 'hidden md:inline'} relative overflow-visible">
-			<Button
-				on:click={() => {
-					jobsDrawerOpen = true
-				}}
-				color="light"
-				unifiedSize={headerBtnSize}
-				variant="default"
-				btnClasses="relative"
-			>
-				<div class="flex flex-row gap-1 items-center">
-					<Bug size={14} />
-					<div>Jobs</div>
+	<div class="{compactTopbar ? 'hidden' : 'hidden md:inline'} relative overflow-visible">
+		<Button
+			on:click={() => {
+				jobsDrawerOpen = true
+			}}
+			color="light"
+			unifiedSize={headerBtnSize}
+			variant="default"
+			btnClasses="relative"
+		>
+			<div class="flex flex-row gap-1 items-center">
+				<Bug size={14} />
+				<div>Jobs</div>
 
-					<div class="text-2xs text-primary"
-						>({jobs?.length > 99 ? '99+' : (jobs?.length ?? 0)})</div
-					>
-				</div>
-			</Button>
-		</div>
-		<AppExportButton bind:this={appExport} />
+				<div class="text-2xs text-primary">({jobs?.length > 99 ? '99+' : (jobs?.length ?? 0)})</div>
+			</div>
+		</Button>
+	</div>
+	<!-- Draws nothing in the bar: it is the export drawer, opened from the menu's Export entry
+	     through this instance. -->
+	<AppExportButton bind:this={appExport} />
+	{#if !phoneTopbar}
 		<OpenInSessionButton source={sessionOpen}>
 			{#snippet fallback()}
 				<Button
@@ -1032,34 +1164,44 @@
 				</Button>
 			{/snippet}
 		</OpenInSessionButton>
-		<Button
-			loading={loading.save}
-			startIcon={{ icon: Save }}
-			on:click={save}
-			unifiedSize={headerBtnSize}
-			variant="accent"
-			dropdownItems={appPath != ''
-				? () => [
-						{
-							label: 'Fork',
-							onClick: () => {
-								window.open(`/apps/add?template=${appPath}`)
-							}
-						},
-						...(!isCloudHosted() && editInForkAllowed(opWorkspace, $userWorkspaces)
-							? [
-									{
-										label: editInForkLabel(opWorkspace, $userWorkspaces),
-										onClick: () => {
-											openEditInFork('raw_app', appPath, opWorkspace)
-										}
+	{/if}
+	<Button
+		loading={loading.save}
+		startIcon={{ icon: Save }}
+		on:click={save}
+		unifiedSize={headerBtnSize}
+		variant="accent"
+		dropdownItems={appPath != ''
+			? () => [
+					// `appPath`, not the live edited path: a rename that has not been deployed yet
+					// would land on a details page for something that does not exist.
+					...(newApp
+						? []
+						: [
+								{
+									label: 'Exit & see details',
+									onClick: () => onDetails?.({ path: appPath })
+								}
+							]),
+					{
+						label: 'Fork',
+						onClick: () => {
+							window.open(`/apps/add?template=${appPath}`)
+						}
+					},
+					...(!isCloudHosted() && editInForkAllowed(opWorkspace, $userWorkspaces)
+						? [
+								{
+									label: editInForkLabel(opWorkspace, $userWorkspaces),
+									onClick: () => {
+										openEditInFork('raw_app', appPath, opWorkspace)
 									}
-								]
-							: [])
-					]
-				: undefined}
-		>
-			Deploy
-		</Button>
-	</div>
-</div>
+								}
+							]
+						: [])
+				]
+			: undefined}
+	>
+		Deploy
+	</Button>
+{/snippet}
diff --git a/frontend/src/lib/components/raw_apps/RawAppPreview.svelte b/frontend/src/lib/components/raw_apps/RawAppPreview.svelte
index 557b2a13ad..9eced2d0e6 100644
--- a/frontend/src/lib/components/raw_apps/RawAppPreview.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppPreview.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
-	import { type UserExt } from '$lib/stores'
-	import RawAppBackgroundRunner from './RawAppBackgroundRunner.svelte'
+	import type { UserExt } from '$lib/stores'
+	import type RawAppBackgroundRunner from './RawAppBackgroundRunner.svelte'
 	import type { Runnable } from './rawAppPolicy'
 	import { getContext, onMount, untrack } from 'svelte'
 	import {
@@ -33,8 +33,7 @@
 		syncHashToUrl?: boolean
 	}
 
-	let { workspace, user, secret, path, runnables, oniframe, syncHashToUrl = true }: Props =
-		$props()
+	let { workspace, user, secret, path, runnables, oniframe, syncHashToUrl = true }: Props = $props()
 	const pageHash = () => (syncHashToUrl ? window.location.hash : '')
 
 	$effect(() => {
@@ -46,6 +45,48 @@
 	})
 
 	let iframe = $state() as HTMLIFrameElement | undefined
+	// White behind apps that set no background of their own, but only once the document
+	// has loaded: before that it would flash under a dark app.
+	let loadedSrc: string | undefined = $state(undefined)
+
+	// The job bridge reaches the generated client and the app shell's stores, which the
+	// bundle's first paint does not need, so it loads alongside the bundle. Requests the
+	// bundle sends before it mounts are queued and handed over in order.
+	const runnerModule = import('./RawAppBackgroundRunner.svelte')
+	let runner: ReturnType<typeof RawAppBackgroundRunner> | undefined = $state()
+	let queuedForRunner: MessageEvent[] = []
+	$effect(() => {
+		if (!runner) return
+		const queued = queuedForRunner
+		queuedForRunner = []
+		for (const event of queued) runner.handleMessage(event)
+	})
+
+	// If the job bridge cannot load (offline, or a chunk a redeploy removed), the bundle
+	// still paints, so its requests are answered with an error rather than left pending.
+	let runnerFailed = false
+	let requestRefused = $state(false)
+	function refuseRequest(event: MessageEvent) {
+		const data = event.data
+		if (typeof data?.type !== 'string' || data.reqId === undefined) return
+		requestRefused = true
+		;(event.source as Window | null)?.postMessage(
+			{
+				type: data.type + 'Res',
+				reqId: data.reqId,
+				error: true,
+				result: { message: 'Could not load the app runtime, reload the page to try again' }
+			},
+			'*'
+		)
+	}
+	runnerModule.catch((e) => {
+		console.error('Could not load the raw app job bridge', e)
+		runnerFailed = true
+		const queued = queuedForRunner
+		queuedForRunner = []
+		for (const event of queued) refuseRequest(event)
+	})
 
 	// Get initial hash from parent URL to pass to the iframe
 	let initialHash = ''
@@ -240,12 +281,16 @@
 						)
 					} catch (_) {}
 				}
-			} else if (data?.type === 'windmill:hashchange' && syncHashToUrl) {
+			} else if (data?.type === 'windmill:hashchange') {
 				// Keep the parent URL hash in sync for shareable URLs.
 				const newHash = data.hash || ''
-				if (window.location.hash !== newHash) {
+				if (syncHashToUrl && window.location.hash !== newHash) {
 					history.replaceState(null, '', newHash || window.location.pathname)
 				}
+			} else if (runnerFailed) {
+				refuseRequest(event)
+			} else if (!runner) {
+				queuedForRunner.push(event)
 			}
 		}
 
@@ -254,14 +299,27 @@
 	})
 </script>
 
-<RawAppBackgroundRunner
-	{workspace}
-	editor={false}
-	{iframe}
-	{runnables}
-	{path}
-	gateJobIds={!unsandboxed}
-/>
+{#await runnerModule then { default: Runner }}
+	<Runner
+		bind:this={runner}
+		{workspace}
+		editor={false}
+		{iframe}
+		{runnables}
+		{path}
+		gateJobIds={!unsandboxed}
+	/>
+{:catch}
+	{#if requestRefused}
+		<!-- Styled inline: neither app.css nor another chunk can be counted on here. -->
+		<div
+			role="alert"
+			style="position: fixed; top: 12px; left: 50%; transform: translateX(-50%); z-index: 1000; padding: 8px 12px; border: 1px solid #fca5a5; border-radius: 6px; background: #fef2f2; color: #991b1b; font: 13px/1.4 system-ui, sans-serif"
+		>
+			Could not load the app runtime. Reload the page to try again.
+		</div>
+	{/if}
+{/await}
 
 {#if iframeSrc}
 	<!-- `unsandboxed` (the default — publisher did not opt into isolation) adds
@@ -271,12 +329,15 @@
 	<!-- referrerpolicy (sandboxed only, for exact legacy parity): the hosting page
 	     URL can carry a viewer credential (the JWT path segment of share links);
 	     without this, the bundle document would see it via document.referrer. -->
+	<!-- Styled inline: on the public app routes it renders before app.css, if ever, loads. -->
 	<iframe
 		bind:this={iframe}
 		title="raw-app"
 		src={iframeSrc}
 		sandbox={sandboxAttr}
 		referrerpolicy={unsandboxed ? undefined : 'no-referrer'}
-		class="w-full h-full min-h-screen bg-white border-none"
+		onload={() => (loadedSrc = iframeSrc)}
+		style="display: block; width: 100%; height: 100%; border: none"
+		style:background={loadedSrc === iframeSrc ? 'white' : 'transparent'}
 	></iframe>
 {/if}
diff --git a/frontend/src/lib/components/raw_apps/RawAppSdkConsent.svelte b/frontend/src/lib/components/raw_apps/RawAppSdkConsent.svelte
index 1f28cd02c0..28940eb02a 100644
--- a/frontend/src/lib/components/raw_apps/RawAppSdkConsent.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppSdkConsent.svelte
@@ -7,16 +7,19 @@
 	let {
 		scopes,
 		onContinue,
-		onDecline
+		onDecline,
+		declineLabel = 'Open without granting'
 	}: {
 		/** Scopes the app policy declares for its frontend SDK token. */
 		scopes: string[]
 		/** Fired when the viewer accepts; `dontAskAgain` persists the consent for
 		 * this app path so the prompt is skipped until the declared scopes grow. */
 		onContinue: (dontAskAgain: boolean) => void
-		/** Fired when the viewer declines: the app still renders, its frontend code
-		 * just gets no token (SDK calls fail). */
+		/** Fired when the viewer declines; no token is minted. */
 		onDecline: () => void
+		/** Says what declining does where the prompt is shown: the deployed app
+		 * still renders tokenless, the editor preview stays blocked. */
+		declineLabel?: string
 	} = $props()
 
 	let dontAskAgain = $state(false)
@@ -34,17 +37,17 @@
 		<ul class="flex flex-col gap-2">
 			{#each scopes as scope (scope)}
 				<li class="text-sm">
-					<span class="font-medium">{sdkScopeLabel(scope)}</span>
-					{#if sdkScopeDescription(scope)}
-						<span class="text-tertiary"> — {sdkScopeDescription(scope)}</span>
-					{/if}
+					<span class="font-medium">{sdkScopeLabel(scope)}</span
+					>{#if sdkScopeDescription(scope)}<span class="text-tertiary"
+							>: {sdkScopeDescription(scope)}</span
+						>{/if}
 				</li>
 			{/each}
 		</ul>
 		<div class="flex items-center justify-between gap-4 pt-2">
 			<Toggle bind:checked={dontAskAgain} size="xs" options={{ right: 'Do not ask again' }} />
 			<div class="flex items-center gap-2">
-				<Button variant="default" onclick={onDecline}>Open without granting</Button>
+				<Button variant="default" onclick={onDecline}>{declineLabel}</Button>
 				<Button variant="accent" onclick={() => onContinue(dontAskAgain)}>Continue</Button>
 			</div>
 		</div>
diff --git a/frontend/src/lib/components/raw_apps/sdkScopes.test.ts b/frontend/src/lib/components/raw_apps/sdkScopes.test.ts
index 68aba9c545..f72918e311 100644
--- a/frontend/src/lib/components/raw_apps/sdkScopes.test.ts
+++ b/frontend/src/lib/components/raw_apps/sdkScopes.test.ts
@@ -1,6 +1,6 @@
 import { beforeEach, describe, expect, it } from 'vitest'
 
-import { hasStoredSdkConsent, storeSdkConsent } from './sdkScopes'
+import { hasStoredSdkConsent, movePreviewSdkConsent, storeSdkConsent } from './sdkScopes'
 
 describe('stored frontend SDK consent', () => {
 	beforeEach(() => localStorage.clear())
@@ -20,6 +20,17 @@ describe('stored frontend SDK consent', () => {
 		expect(hasStoredSdkConsent('a@w.dev', 'other', 'u/a/app', ['users:read'])).toBe(false)
 	})
 
+	it('keeps the editor preview and the deployed app apart, and moves preview consent', () => {
+		storeSdkConsent('a@w.dev', 'ws', 'u/a/app', ['users:read'])
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/app', ['users:read'], true)).toBe(false)
+		storeSdkConsent('a@w.dev', 'ws', 'u/a/draft_1', ['users:read'], true)
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/draft_1', ['users:read'])).toBe(false)
+
+		movePreviewSdkConsent('a@w.dev', 'ws', 'u/a/draft_1', 'u/a/real')
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/real', ['users:read'], true)).toBe(true)
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/draft_1', ['users:read'], true)).toBe(false)
+	})
+
 	it('treats unreadable storage as no consent', () => {
 		localStorage.setItem('wm_sdk_consent:a@w.dev:ws:u/a/app', 'not json')
 		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/app', ['users:read'])).toBe(false)
diff --git a/frontend/src/lib/components/raw_apps/sdkScopes.ts b/frontend/src/lib/components/raw_apps/sdkScopes.ts
index b0177bb660..238f1b7278 100644
--- a/frontend/src/lib/components/raw_apps/sdkScopes.ts
+++ b/frontend/src/lib/components/raw_apps/sdkScopes.ts
@@ -52,8 +52,17 @@ export function sdkScopeDescription(scope: string): string | undefined {
 // Keyed by viewer as well as app: this localStorage lives on the shared embedder
 // origin, so without the viewer one person's "do not ask again" would silently
 // suppress the prompt for the next person to use the same browser profile.
-function sdkConsentKey(viewer: string, workspace: string, path: string): string {
-	return `wm_sdk_consent:${viewer}:${workspace}:${path}`
+// `preview` keeps the editor's consent apart from the deployed app's: the editor
+// runs a draft nobody may have reviewed, so trust given to one is not trust given
+// to the other.
+function sdkConsentKey(viewer: string, workspace: string, path: string, preview: boolean): string {
+	return `wm_sdk_consent:${preview ? 'p:' : ''}${viewer}:${workspace}:${path}`
+}
+
+/** True when `approved` (a consent the viewer gave) covers every scope the app now
+ * declares. Fewer scopes need no new consent; one more does. */
+export function sdkConsentCovers(approved: unknown, scopes: string[]): boolean {
+	return Array.isArray(approved) && scopes.every((s) => approved.includes(s))
 }
 
 /** True when a previously stored "do not ask again" consent covers every
@@ -62,13 +71,14 @@ export function hasStoredSdkConsent(
 	viewer: string,
 	workspace: string,
 	path: string,
-	scopes: string[]
+	scopes: string[],
+	preview = false
 ): boolean {
 	try {
 		const stored = JSON.parse(
-			localStorage.getItem(sdkConsentKey(viewer, workspace, path)) ?? 'null'
+			localStorage.getItem(sdkConsentKey(viewer, workspace, path, preview)) ?? 'null'
 		)
-		return Array.isArray(stored) && scopes.every((s) => stored.includes(s))
+		return sdkConsentCovers(stored, scopes)
 	} catch (_) {
 		return false
 	}
@@ -78,9 +88,29 @@ export function storeSdkConsent(
 	viewer: string,
 	workspace: string,
 	path: string,
-	scopes: string[]
+	scopes: string[],
+	preview = false
 ): void {
 	try {
-		localStorage.setItem(sdkConsentKey(viewer, workspace, path), JSON.stringify(scopes))
+		localStorage.setItem(sdkConsentKey(viewer, workspace, path, preview), JSON.stringify(scopes))
+	} catch (_) {}
+}
+
+/** Follows the editor's app to its new path (first deploy of a draft, or a rename),
+ * so a stored "do not ask again" consent neither is asked again nor stays behind
+ * under the old path. A plain Continue is not stored and does not carry over. */
+export function movePreviewSdkConsent(
+	viewer: string,
+	workspace: string,
+	from: string,
+	to: string
+): void {
+	if (from === to) return
+	try {
+		const fromKey = sdkConsentKey(viewer, workspace, from, true)
+		const stored = localStorage.getItem(fromKey)
+		if (stored === null) return
+		localStorage.setItem(sdkConsentKey(viewer, workspace, to, true), stored)
+		localStorage.removeItem(fromKey)
 	} catch (_) {}
 }
diff --git a/frontend/src/lib/components/raw_apps/utils.ts b/frontend/src/lib/components/raw_apps/utils.ts
index bdbf62ef8a..3070572785 100644
--- a/frontend/src/lib/components/raw_apps/utils.ts
+++ b/frontend/src/lib/components/raw_apps/utils.ts
@@ -92,6 +92,8 @@ export type RawAppPreviewLogs = {
 	/** Files were sent to the UI Builder and its build has not reported back in time. */
 	buildPending: boolean
 	buildLogs: string
+	/** The app is held back until the user answers its SDK permission prompt, so it is not running. */
+	sdkConsentPending: boolean
 }
 export type RawAppRuntimeLogRequester = (limit: number) => Promise<RawAppPreviewLogs>
 
@@ -292,6 +294,9 @@ export function unsandboxedRawAppHtml(
 <head>
 	<meta charset="UTF-8" />
 	<title>App</title>
+	<!-- Before the app's own stylesheet, so a bundle that wants a margin can still set one: the
+	     browser default of 8px would otherwise frame every app with a gap it never asked for. -->
+	<style>html, body { margin: 0; }</style>
 	<link rel="stylesheet" href="${baseUrl}/api/w/${workspace}/apps_u/get_data/v/${secret}.css" />
 	<script>
 		window.ctx = ${ctx ? JSON.stringify(ctx).replace(/</g, '\\u003c') : 'undefined'};
diff --git a/frontend/src/lib/components/runs/RunsQueue.svelte b/frontend/src/lib/components/runs/RunsQueue.svelte
index 2cd2914878..4fbfe8842d 100644
--- a/frontend/src/lib/components/runs/RunsQueue.svelte
+++ b/frontend/src/lib/components/runs/RunsQueue.svelte
@@ -28,7 +28,9 @@
 	{#if small}
 		<Popover contentClasses="p-4" openOnHover debounceDelay={100}>
 			{#snippet trigger()}
-				<div class="relative">
+				<!-- mr-2: the count badge hangs half outside this box, so the margin — not the row's
+				     gap — is what keeps it off whatever sits to the right. -->
+				<div class="relative mr-2">
 					<ServerCog size={16} />
 					{#if queue_count && ($queue_count ?? 0) > 0}
 						<div
@@ -49,14 +51,11 @@
 	{/if}
 
 	{#if small}
-		<Popover
-			contentClasses="p-4"
-			openOnHover
-			debounceDelay={100}
-			disablePopup={!suspended_count || ($suspended_count ?? 0) <= 0}
-		>
+		<!-- The icon is on the bar whatever the count, so it answers a hover whatever the count —
+		     a disabled trigger takes no pointer events and reads as a dead icon. -->
+		<Popover contentClasses="p-4" openOnHover debounceDelay={100}>
 			{#snippet trigger()}
-				<div class="relative">
+				<div class="relative mr-2">
 					<Hourglass size={16} />
 					<div
 						class="absolute top-0 right-0 translate-x-1/2 -translate-y-1/2 bg-surface-secondary-inverse rounded-full text-primary-inverse text-2xs h-4 min-w-4 px-1"
@@ -69,7 +68,7 @@
 				{@render suspendedContent()}
 			{/snippet}
 		</Popover>
-	{:else}
+	{:else if suspended_count && ($suspended_count ?? 0) > 0}
 		{@render suspendedContent()}
 	{/if}
 </div>
@@ -103,28 +102,28 @@
 {/snippet}
 
 {#snippet suspendedContent()}
-	{#if suspended_count && ($suspended_count ?? 0) > 0}
-		<RunOption label="Suspended">
-			{#snippet tooltip()}
-				Jobs waiting for an event or approval before being resumed
-			{/snippet}
-			<div
-				class={suspended_count && ($suspended_count ?? 0) > 0
-					? 'bg-surface-secondary-inverse text-primary-inverse rounded-full min-w-6 h-6 flex center-center'
-					: ''}>{suspended_count ? ($suspended_count ?? 0).toFixed(0) : '...'}</div
-			>
-			<div class="truncate text-2xs !text-secondary">
-				<Button unifiedSize="md" variant="subtle" on:click={() => onJobsSuspended?.()}>
-					{#if success == 'suspended'}
-						<div class="flex flex-row items-center gap-1">
-							Reset filter
-							<X size={12} />
-						</div>
-					{:else}
-						<ListFilterPlus size={14} />
-					{/if}
-				</Button>
-			</div>
-		</RunOption>
-	{/if}
+	<RunOption label="Suspended">
+		{#snippet tooltip()}
+			Jobs waiting for an event or approval before being resumed
+		{/snippet}
+		<div
+			class={suspended_count && ($suspended_count ?? 0) > 0
+				? 'bg-surface-secondary-inverse text-primary-inverse rounded-full min-w-6 h-6 flex center-center'
+				: ''}
+		>
+			{suspended_count ? ($suspended_count ?? 0).toFixed(0) : '...'}
+		</div>
+		<div class="truncate text-2xs !text-secondary">
+			<Button unifiedSize="md" variant="subtle" on:click={() => onJobsSuspended?.()}>
+				{#if success == 'suspended'}
+					<div class="flex flex-row items-center gap-1">
+						Reset filter
+						<X size={12} />
+					</div>
+				{:else}
+					<ListFilterPlus size={14} />
+				{/if}
+			</Button>
+		</div>
+	</RunOption>
 {/snippet}
diff --git a/frontend/src/lib/components/runs/TimeframeSelect.svelte b/frontend/src/lib/components/runs/TimeframeSelect.svelte
index f8d2b0df71..7daa75f5fa 100644
--- a/frontend/src/lib/components/runs/TimeframeSelect.svelte
+++ b/frontend/src/lib/components/runs/TimeframeSelect.svelte
@@ -3,7 +3,8 @@
 		type Timeframe,
 		buildManualTimeframe,
 		serviceLogsTimeframes,
-		runsTimeframes
+		runsTimeframes,
+		auditTimeframes
 	} from './timeframes'
 	import { type Timeframe, buildManualTimeframe } from './timeframes'
 
@@ -77,7 +78,7 @@
 
 <script lang="ts">
 	import { CalendarIcon, RefreshCw } from 'lucide-svelte'
-	import { Button } from '../common'
+	import { Button, type ButtonType } from '../common'
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import Popover from '../meltComponents/Popover.svelte'
@@ -94,9 +95,18 @@
 		value: Timeframe
 		wrapperClasses?: string
 		onClick?: () => void
+		/** Sizes the three buttons of the control itself; the presets inside the popover keep md. */
+		unifiedSize?: ButtonType.UnifiedSize
 	}
 
-	let { loading = false, onClick, items, value = $bindable(), wrapperClasses }: Props = $props()
+	let {
+		loading = false,
+		onClick,
+		items,
+		value = $bindable(),
+		wrapperClasses,
+		unifiedSize = 'md'
+	}: Props = $props()
 
 	let isOpen = $state(false)
 
@@ -141,7 +151,7 @@
 
 <div class="relative flex {wrapperClasses}">
 	<Button
-		unifiedSize="md"
+		{unifiedSize}
 		wrapperClasses="flex-1"
 		btnClasses="!rounded-r-none whitespace-nowrap"
 		onClick={() => onClick?.()}
@@ -154,7 +164,7 @@
 	{#if value.type === 'manual'}
 		<Button
 			btnClasses="!rounded-none border-l-0"
-			unifiedSize="md"
+			{unifiedSize}
 			onClick={() => (value = { ...items[0] })}
 		>
 			Reset
@@ -168,7 +178,7 @@
 	>
 		{#snippet trigger()}
 			<Button
-				unifiedSize="md"
+				{unifiedSize}
 				iconOnly
 				btnClasses="!rounded-l-none border-l-0"
 				endIcon={{ icon: CalendarIcon }}
diff --git a/frontend/src/lib/components/runs/timeframes.ts b/frontend/src/lib/components/runs/timeframes.ts
index 9e46dd1bd8..dbc624d323 100644
--- a/frontend/src/lib/components/runs/timeframes.ts
+++ b/frontend/src/lib/components/runs/timeframes.ts
@@ -39,6 +39,15 @@ export const serviceLogsTimeframes: Timeframe[] = [
 	{ label: 'Within last month', computeMinMax: () => computeMinMaxInc(30 * 24 * 60 * 60 * 1000) }
 ].map((item) => ({ ...item, type: 'dynamic' }))
 
+export const auditTimeframes: Timeframe[] = [
+	{ label: 'All time', computeMinMax: () => ({ minTs: null, maxTs: null }) },
+	{ label: 'Within last 30 minutes', computeMinMax: () => computeMinMaxInc(30 * 60 * 1000) },
+	{ label: 'Within last 24 hours', computeMinMax: () => computeMinMaxInc(24 * 60 * 60 * 1000) },
+	{ label: 'Within last 7 days', computeMinMax: () => computeMinMaxInc(7 * 24 * 60 * 60 * 1000) },
+	{ label: 'Within last month', computeMinMax: () => computeMinMaxInc(30 * 24 * 60 * 60 * 1000) },
+	{ label: 'Within last year', computeMinMax: () => computeMinMaxInc(365 * 24 * 60 * 60 * 1000) }
+].map((item) => ({ ...item, type: 'dynamic' }))
+
 export const runsTimeframes: Timeframe[] = [
 	{ label: 'Latest runs', computeMinMax: () => ({ minTs: null, maxTs: null }) },
 	{ label: 'Within 30 seconds', computeMinMax: () => computeMinMaxInc(30 * 1000) },
diff --git a/frontend/src/lib/components/script_builder.ts b/frontend/src/lib/components/script_builder.ts
index c28aad82cc..4249441d20 100644
--- a/frontend/src/lib/components/script_builder.ts
+++ b/frontend/src/lib/components/script_builder.ts
@@ -57,6 +57,7 @@ export interface ScriptBuilderProps {
 		| 'docker'
 		| 'bunnative'
 		| 'claudesandbox'
+		| 'pisandbox'
 		| 'wac_python'
 		| 'wac_typescript'
 		| 'ci_test_bun'
@@ -113,4 +114,6 @@ export interface ScriptBuilderProps {
 	// EditorHeader's path/breadcrumb row dropped (summary only). Used by the
 	// session preview to save vertical room.
 	condensedHeader?: boolean
+	/** True for the route's own editor: its top bar becomes the page header. */
+	ownsPageHeader?: boolean
 }
diff --git a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
index 4e453c09a3..00b784138f 100644
--- a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
+++ b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
@@ -69,7 +69,7 @@
 		 * says that clicking it leaves for a session. */
 		tooltip?: string
 		/** Rendered instead when the caller keeps a docked chat to drive — an
-		 * opted-out user or an operator (typically the editor's inline-chat
+		 * opted-out user (typically the editor's inline-chat
 		 * toggle). Never rendered inside the session panel. */
 		fallback?: Snippet
 	} = $props()
diff --git a/frontend/src/lib/components/sessions/PipelineEditorView.svelte b/frontend/src/lib/components/sessions/PipelineEditorView.svelte
index b1e461eb32..d6e9f28935 100644
--- a/frontend/src/lib/components/sessions/PipelineEditorView.svelte
+++ b/frontend/src/lib/components/sessions/PipelineEditorView.svelte
@@ -1,9 +1,10 @@
 <script lang="ts">
 	import { resource } from 'runed'
-	import { tick, untrack } from 'svelte'
-	import { Loader2, Workflow } from 'lucide-svelte'
+	import { onDestroy, tick, untrack } from 'svelte'
+	import { Loader2, Save, Workflow } from 'lucide-svelte'
 	import PipelineGraphEditor from '$lib/components/assets/AssetGraph/PipelineGraphEditor.svelte'
 	import PipelineTriggerEditors from '$lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte'
+	import { usePipelineDataUploads } from '$lib/components/assets/AssetGraph/pipelineDataUploads.svelte'
 	import { resolveGraph } from '$lib/components/assets/AssetGraph/resolveGraph'
 	import { useActiveRunnableIds } from '$lib/components/assets/AssetGraph/activeRunnables.svelte'
 	import type {
@@ -11,10 +12,26 @@
 		AssetGraphSelection,
 		NativeTriggerKind
 	} from '$lib/components/assets/AssetGraph/types'
-	import { AssetService, JobService, type AssetKind } from '$lib/gen'
+	import { AssetService, JobService, type ScriptLang } from '$lib/gen'
+	import { DATA_ASSET_KINDS } from '$lib/components/assets/AssetGraph/cascadeRun'
+	import { usePipelineAssetPrefetch } from '$lib/components/assets/AssetGraph/pipelineAssetPrefetch.svelte'
 	import { sendUserToast } from '$lib/utils'
 	import { createPipelineAiHelpers } from '$lib/components/assets/AssetGraph/pipelineAiHelpers'
+	import { deployPipelineDrafts } from '$lib/components/assets/AssetGraph/pipelineDeploy.svelte'
+	import {
+		diffDeployedGraph,
+		extractCascadeFacts,
+		formatDrift
+	} from '$lib/components/assets/AssetGraph/deployGraphDiff'
+	import PipelineDeployErrors from '$lib/components/assets/AssetGraph/PipelineDeployErrors.svelte'
+	import PipelineDeployTriggersModal from '$lib/components/assets/AssetGraph/PipelineDeployTriggersModal.svelte'
+	import AutosaveIndicator from '$lib/components/AutosaveIndicator.svelte'
+	import { Button } from '$lib/components/common'
+	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+	import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
+	import type { DeployResult } from '$lib/utils_workspace_deploy'
 	import type { SessionRuntime } from './sessionRuntime.svelte'
+	import { maskKey } from './modifiedItemsMask'
 
 	let {
 		runtime,
@@ -29,7 +46,7 @@
 		/** Folder name the pipeline graph is scoped to (not a workspace item path). */
 		path: string
 		workspaceId: string
-		/** Only the visible session registers the pipeline tools on its manager. */
+		/** Only the visible session polls the live run badges. */
 		isActiveSession?: boolean
 		/** Whether this is the foreground preview tab. */
 		active?: boolean
@@ -43,50 +60,36 @@
 	// wrong chat — leaving this session's chat unable to build canvas nodes.
 	const aiChatManager = runtime.manager
 
-	// Only the foreground tab of the foreground session owns the chat's pipeline
-	// tools and runs the live-badge poll — a background tab (another preview tab is
-	// showing, or another session is active) must not shadow that context or poll.
+	// Only the foreground tab of the foreground session runs the live-badge poll.
 	const engaged = $derived(isActiveSession && active)
 
-	// Externalized editor state — lives on the runtime so the drafts persist across
-	// hide/show of the preview pane (the pane unmounts on hide).
-	const pe = runtime.pipelineEditorState
-
-	// The reused `pe` is scoped to a folder. A same-folder remount (hide→show)
-	// keeps the drafts; a retarget to a different folder resets so stale drafts
-	// don't bleed across folders. untrack the writes so this can't self-loop.
-	$effect(() => {
-		const folder = path
-		untrack(() => {
-			if (pe.folder !== folder) {
-				if (pe.folder !== undefined) {
-					pe.reset()
-					// A retarget without remount re-scopes the poll, so the release
-					// effect could never match the old folder's job — drop the hint.
-					activeRunnable = undefined
-					activeRunnableJobId = undefined
-					// Re-scope the Global pipeline prompt to the new folder (the helper
-					// methods already read the reactive path, but the system message
-					// string was built for the old one). Only when this tab is engaged —
-					// its helpers are the registered set; a background tab reconfigures
-					// when it next becomes the foreground one.
-					if (engaged) aiChatManager.rebuildGlobalSystemMessage()
-				}
-				pe.folder = folder
-			}
-		})
-	})
+	// This folder's editor state lives on the runtime, so its drafts survive a
+	// remount. The host remounts this view when the tab moves to another folder, so
+	// `path` is fixed for its lifetime.
+	const pe = untrack(() => runtime.pipelineEditor(path))
 
 	const EMPTY_GRAPH: AssetGraphResponse = { assets: [], runnables: [], edges: [], triggers: [] }
-	const EMPTY_PATH_MAP = new Map<string, Array<{ kind: AssetKind; path: string }>>()
-	const EMPTY_NATIVE_MAP = new Map<string, Set<any>>()
 
+	// Data assets only, as on the pipeline page: variables and resources are
+	// config most scripts reference, and would swamp the layout as hub nodes.
 	const graphRes = resource(
 		() => ({ workspace: workspaceId, folder: path }),
 		async ({ workspace, folder }) =>
-			workspace && folder ? await AssetService.getAssetsGraph({ workspace, folder }) : EMPTY_GRAPH
+			workspace && folder
+				? await AssetService.getAssetsGraph({
+						workspace,
+						folder,
+						assetKinds: DATA_ASSET_KINDS.join(',')
+					})
+				: EMPTY_GRAPH
 	)
 
+	const assetPrefetch = usePipelineAssetPrefetch({
+		getWorkspace: () => workspaceId,
+		getGraph: () => graphRes.current as AssetGraphResponse | undefined,
+		editor: pe
+	})
+
 	// Folder whose graph is actually rendered — `graphRes.current` is stale-
 	// while-revalidate on a folder retarget, so the canvas's one-shot initial
 	// fit is keyed on the folder captured when a graph lands, not on `path`
@@ -97,9 +100,7 @@
 	})
 
 	// Deployed graph + the in-flight draft overlay (AI-built nodes render as plain
-	// dashed unsaved drafts, same as manual drafts). The session
-	// skips the route page's folder-wide asset prefetch (empty inferred maps); the
-	// open script's live overlays still feed the graph. (resolveGraph's base is the
+	// dashed unsaved drafts, same as manual drafts). (resolveGraph's base is the
 	// pipeline runnables subset; the 'job' usage_kind of the wire type never appears.)
 	let resolvedGraph = $derived.by<AssetGraphResponse>(() =>
 		resolveGraph({
@@ -107,9 +108,10 @@
 			drafts: pe.drafts,
 			liveBodyAssets: pe.liveBodyAssets,
 			liveAnnotations: pe.liveAnnotations,
-			inferredWritesByPath: EMPTY_PATH_MAP,
-			inferredReadsByPath: EMPTY_PATH_MAP,
-			annotatedNativeKindsByPath: EMPTY_NATIVE_MAP
+			inferredWritesByPath: assetPrefetch.inferredWritesByPath,
+			inferredReadsByPath: assetPrefetch.inferredReadsByPath,
+			annotatedNativeKindsByPath: assetPrefetch.annotatedNativeKindsByPath,
+			triggerDrafts: pe.triggerDrafts.values()
 		})
 	)
 
@@ -120,7 +122,13 @@
 		getDrafts: () => pe.drafts,
 		setDrafts: (next) => (pe.drafts = next),
 		newDraftLocalId: pe.newDraftLocalId,
-		onForgetPath: pe.forgetPath,
+		hasTriggerDrafts: () => pe.triggerDrafts.size > 0,
+		getTriggerDrafts: () => pe.triggerDrafts,
+		setTriggerDraft: pe.setTriggerDraft,
+		onForgetPath: (p) => {
+			pe.forgetPath(p)
+			pe.discardTriggerDraftsFor(p)
+		},
 		// Open the staged node in the details pane so its code is visible.
 		onProposeNode: (p) => {
 			pe.activeDraftPath = p
@@ -135,6 +143,7 @@
 	})
 
 	function handleCanvasSelect(s: AssetGraphSelection | undefined) {
+		uploadInputsPath = undefined
 		if (s && s.kind === 'runnable' && s.runnable_kind === 'script' && pe.drafts.has(s.path)) {
 			pe.activeDraftPath = s.path
 			pe.selection = undefined
@@ -145,6 +154,7 @@
 	}
 
 	async function afterSaved(savedPath: string) {
+		assetPrefetch.forget(savedPath)
 		const next = new Map(pe.drafts)
 		next.delete(savedPath)
 		pe.drafts = next
@@ -194,7 +204,11 @@
 
 	// Data upload has no trigger row — open the target in the details pane and pulse
 	// the signal so its auto-generated run form focuses the S3 input.
+	// A data-upload click opens the node on its inputs alone; any other selection
+	// (or "Open script") goes back to the editor.
+	let uploadInputsPath = $state<string | undefined>(undefined)
 	function openDataUploadRun(scriptPath: string) {
+		uploadInputsPath = scriptPath
 		if (pe.drafts.has(scriptPath)) {
 			pe.activeDraftPath = scriptPath
 			pe.selection = undefined
@@ -236,29 +250,40 @@
 		}
 	})
 
+	const dataUploads = usePipelineDataUploads(() => resolvedGraph)
+
 	function runProducer(producer: { kind: 'script' | 'flow'; path: string; cascade?: boolean }) {
 		// Pipeline nodes are scripts; a flow producer can't be preview/by-path run.
 		if (producer.kind !== 'script') return Promise.resolve(undefined)
-		return runNode(producer.path, {}, producer.cascade ?? false)
+		// A data-upload entry runs on the file staged in its run form.
+		return runNode(producer.path, dataUploads.argsFor(producer.path) ?? {}, producer.cascade ?? false)
 	}
 
+	// Tell the open node's runs list a job started, so it shows it right away.
+	let runsRefreshKey = $state(0)
+	let runsPendingJobId = $state<string | undefined>(undefined)
+
+	// `live` is an open editor's body, newer than what is stored: it is previewed,
+	// a deployed node included.
 	async function runNode(
 		nodePath: string,
 		args: Record<string, any> = {},
-		cascade = false
+		cascade = false,
+		live?: { content: string; language: ScriptLang }
 	): Promise<string | undefined> {
 		const draft = pe.drafts.get(nodePath)
+		const body = live ?? (draft && { content: draft.script.content, language: draft.script.language })
 		activeRunnables.arm(`script:${nodePath}`)
 		try {
 			let jobId: string
-			if (draft) {
-				// Preview-run the draft content; a preview never dispatches downstream.
+			if (body) {
+				// Preview-run the unsaved body; a preview never dispatches downstream.
 				jobId = await JobService.runScriptPreview({
 					workspace: workspaceId,
 					requestBody: {
 						path: nodePath,
-						content: draft.script.content,
-						language: draft.script.language,
+						content: body.content,
+						language: body.language,
 						args
 					}
 				})
@@ -275,6 +300,8 @@
 			}
 			activeRunnable = { kind: 'script', path: nodePath }
 			activeRunnableJobId = jobId
+			runsPendingJobId = jobId
+			runsRefreshKey++
 			return jobId
 		} catch (e: any) {
 			sendUserToast(`Run failed: ${e?.body ?? e?.message ?? e}`, true)
@@ -282,14 +309,126 @@
 		}
 	}
 
-	// Register the pipeline tools on this session's manager while this tab is the
-	// engaged (foreground) one. setPipelineHelpers rebuilds the global tool set to
-	// include the pipeline tools and tears them down on cleanup — so switching to
-	// another preview tab or session releases them.
-	$effect(() => {
-		if (!engaged) return
-		return aiChatManager.setPipelineHelpers(helpers)
-	})
+	// Register this folder's pipeline tools on the session's own manager for as long
+	// as the view is mounted — background tabs included, since each folder's tools
+	// act on its own state — and release them on unmount.
+	$effect(() => aiChatManager.setPipelineHelpers(helpers))
+
+	// ── Deploy all ───────────────────────────────────────────────────────────
+	// The same deploy as the pipeline page's "Save all", reached from this tab's
+	// button and from the session's changes list (through the runtime).
+	const pendingCount = $derived(
+		pe.drafts.size + pe.triggerDrafts.size + (pe.liveEditPath != undefined ? 1 : 0)
+	)
+	let deploying = $state(false)
+	let deployErrors = $state<Map<string, string>>(new Map())
+	let deployErrorsOpen = $state(false)
+
+	let triggerConfirmOpen = $state(false)
+	let resolveTriggerConfirm: ((ok: boolean) => void) | undefined
+	function confirmTriggers(): Promise<boolean> {
+		triggerConfirmOpen = true
+		return new Promise((resolve) => (resolveTriggerConfirm = resolve))
+	}
+	function answerTriggerConfirm(ok: boolean) {
+		triggerConfirmOpen = false
+		resolveTriggerConfirm?.(ok)
+		resolveTriggerConfirm = undefined
+	}
+
+	// A deploy asked for from the changes list can arrive while the tab is still
+	// loading this folder's drafts.
+	async function hydrated(timeoutMs = 10000): Promise<boolean> {
+		for (let waited = 0; !pe.hydratedFromDb && waited < timeoutMs; waited += 100) {
+			await new Promise((resolve) => setTimeout(resolve, 100))
+		}
+		return pe.hydratedFromDb
+	}
+
+	async function deployAll(): Promise<DeployResult> {
+		// Taken before any await: a second caller (the tab's button and the changes
+		// list both reach here) would otherwise replace the pending confirmation and
+		// leave the first one waiting forever.
+		if (deploying) return { success: false, error: 'This pipeline is already deploying.' }
+		deploying = true
+		try {
+			if (!(await hydrated())) return { success: false, error: 'The pipeline drafts did not load.' }
+			if (pendingCount === 0) {
+				// Nothing left to deploy, but an earlier deploy may have failed to save
+				// that: the server would still hold the deployed drafts.
+				const unsaved = await saveRemaining()
+				return unsaved ? { success: false, error: unsaved } : { success: true }
+			}
+			if (pe.triggerDrafts.size > 0 && !(await confirmTriggers())) {
+				return { success: false, error: 'Deploy cancelled.' }
+			}
+			// What the canvas promises for each draft, checked against what the
+			// backend derived once deployed.
+			const predicted = new Map(
+				[...pe.drafts.keys()].map((p) => [p, extractCascadeFacts(resolvedGraph, p)])
+			)
+			const { savedPaths, savedTriggers, errors } = await deployPipelineDrafts(pe, workspaceId)
+			assetPrefetch.forget(...savedPaths)
+			const bundleKey = maskKey(PIPELINE_DRAFT_KIND, pipelineBundlePath(path))
+			if (aiChatManager.modifiedItems?.has(bundleKey)) {
+				await aiChatManager.recordDeployedItems('script', savedPaths)
+			}
+			if (savedPaths.length > 0 || savedTriggers.length > 0) {
+				await graphRes.refetch()
+				const deployed = new Map([...predicted].filter(([p]) => savedPaths.includes(p)))
+				const drift = formatDrift(
+					diffDeployedGraph(deployed, (graphRes.current ?? EMPTY_GRAPH) as AssetGraphResponse)
+				)
+				if (drift) sendUserToast(drift, true)
+			}
+			// The session's changes list re-reads the draft once this resolves, so
+			// what is left of it has to be saved by then.
+			const unsaved = await saveRemaining()
+			deployErrors = errors
+			if (unsaved) return { success: false, error: `Deployed, but ${unsaved}` }
+			if (errors.size > 0) {
+				deployErrorsOpen = true
+				return {
+					success: false,
+					error: `${errors.size} of the pipeline's drafts failed to deploy, see its tab.`
+				}
+			}
+			return { success: true }
+		} finally {
+			deploying = false
+		}
+	}
+
+	// Saves what is left of the folder's draft and says why if that failed. A
+	// flush resolves even when the save failed, and the server would then keep
+	// drafts already deployed — deploying them again would recreate their
+	// triggers. A failed save stays queued until one succeeds, so the flush
+	// retries exactly what failed, an open script's unsaved edits included.
+	async function saveRemaining(): Promise<string | undefined> {
+		await tick()
+		const draft = {
+			workspace: workspaceId,
+			itemKind: PIPELINE_DRAFT_KIND,
+			path: pipelineBundlePath(path)
+		}
+		await UserDraftDbSyncer.flush(draft)
+		if (UserDraftDbSyncer.getConflict(draft).conflict)
+			return 'the remaining drafts conflict with a newer version.'
+		const sync = UserDraftDbSyncer.getState(draft)
+		if (sync.state === 'failed')
+			return `the remaining drafts could not be saved: ${sync.failureMessage ?? 'unknown error'}.`
+		return undefined
+	}
+
+	async function deployAllFromButton() {
+		const count = pendingCount
+		const res = await deployAll()
+		if (res.success) sendUserToast(`Deployed ${count} draft${count === 1 ? '' : 's'}`)
+	}
+
+	$effect(() => runtime.registerPipelineView(path, { deployAll }))
+	// A deploy waiting on the trigger confirmation must still settle when the tab goes.
+	onDestroy(() => answerTriggerConfirm(false))
 </script>
 
 <div class="flex flex-col h-full w-full bg-surface">
@@ -299,6 +438,31 @@
 		<Workflow size={14} />
 		<span class="font-mono text-emphasis truncate">f/{path}</span>
 		<span class="text-tertiary">· data pipeline</span>
+		{#if workspaceId}
+			<AutosaveIndicator
+				workspace={workspaceId}
+				itemKind={PIPELINE_DRAFT_KIND}
+				path={pipelineBundlePath(path)}
+				draftOnly
+				loadedFromDraft={pe.loadedFromDbDraft}
+			/>
+		{/if}
+		<div class="flex-1"></div>
+		{#if deployErrors.size > 0}
+			<PipelineDeployErrors errors={deployErrors} bind:open={deployErrorsOpen} />
+		{/if}
+		{#if pendingCount > 0}
+			<Button
+				variant="accent"
+				unifiedSize="xs"
+				startIcon={{ icon: deploying ? Loader2 : Save }}
+				onclick={deployAllFromButton}
+				disabled={deploying}
+				title={deploying ? 'Deploying drafts…' : `Deploy all ${pendingCount} drafts`}
+			>
+				{deploying ? 'Deploying…' : `Deploy all (${pendingCount})`}
+			</Button>
+		{/if}
 	</div>
 	<div class="flex-1 min-h-0">
 		<!-- Only block on the deployed-graph fetch when there's nothing to show yet.
@@ -328,6 +492,8 @@
 				folder={path}
 				viewportFitKey={viewportFitFolder}
 				persistDrafts={true}
+				modalPanel
+				prefetchingAssets={assetPrefetch.prefetching}
 				displayGraph={resolvedGraph}
 				mode="edit"
 				workspace={workspaceId}
@@ -338,12 +504,21 @@
 				onOpenWebhook={openWebhookDrawer}
 				onOpenDataUpload={openDataUploadRun}
 				focusUploadSignal={focusDataUploadSignal}
+				readyDataUploadPaths={dataUploads.readyPaths}
+				runFormInitialArgs={pe.openScriptPath ? dataUploads.argsFor(pe.openScriptPath) : undefined}
+				onRunFormArgsChange={dataUploads.stage}
 				{activeRunnable}
+				{runsRefreshKey}
+				{runsPendingJobId}
 				activeRunnableIds={activeRunnables.ids}
 				runStates={activeRunnables.states}
 				eventLogEvents={activeRunnables.events}
 				onRunProducer={runProducer}
 				onRunByPath={(path, args) => runNode(path, args)}
+				inputsOnly={uploadInputsPath !== undefined &&
+					(pe.openScriptPath === undefined || uploadInputsPath === pe.openScriptPath)}
+				onRunInputs={(path, args, live) => runNode(path, args, false, live)}
+				onShowScript={() => (uploadInputsPath = undefined)}
 				canRunByPath
 				onTestStateChange={(running) => {
 					const openPath = pe.openScriptPath
@@ -370,6 +545,7 @@
 					await graphRes.refetch()
 				}}
 				onScriptRenamed={async (oldPath, newPath) => {
+					assetPrefetch.forget(oldPath, newPath)
 					// Repoint the selection so the canvas follows the renamed node instead
 					// of staying on the now-gone old path until an unrelated refetch.
 					if (pe.selection?.kind === 'runnable' && pe.selection.path === oldPath) {
@@ -402,3 +578,10 @@
 	workspace={workspaceId}
 	onUpdate={() => graphRes.refetch()}
 />
+
+<PipelineDeployTriggersModal
+	open={triggerConfirmOpen}
+	triggerDrafts={pe.triggerDrafts}
+	onConfirmed={() => answerTriggerConfirm(true)}
+	onCanceled={() => answerTriggerConfirm(false)}
+/>
diff --git a/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte b/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
index 1795c17fe5..1317fc2651 100644
--- a/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
+++ b/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
@@ -16,8 +16,9 @@ section or the flat layout.
 
 <script lang="ts">
 	import { untrack } from 'svelte'
-	import { Compass, FileText, Pen } from 'lucide-svelte'
+	import { Compass, FileText, NetworkIcon, Pen } from 'lucide-svelte'
 	import { resource } from 'runed'
+	import { AssetService } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
 	import {
@@ -228,9 +229,38 @@ section or the flat layout.
 			: undefined
 	)
 
+	// Data pipelines are folders, not items, so they get a branch of their own
+	// rather than a leaf in the workspace tree.
+	const pipelinesResource = resource(
+		() => effectiveWorkspace,
+		async (ws) => (ws ? await AssetService.listPipelineFolders({ workspace: ws }) : [])
+	)
+	const pipelinesBranch = $derived<DrillBranch<PreviewTarget> | undefined>(
+		pipelinesResource.current && pipelinesResource.current.length > 0
+			? {
+					type: 'branch',
+					key: 'pipelines',
+					label: 'Data pipelines',
+					icon: NetworkIcon,
+					searchGroup: true,
+					children: pipelinesResource.current.map(({ folder }) => {
+						const path = `/pipeline/${encodeURIComponent(folder)}`
+						return {
+							type: 'leaf' as const,
+							key: pageKey(path),
+							label: `f/${folder}`,
+							icon: NetworkIcon,
+							data: { type: 'page', href: pageHref(path), label: folder }
+						}
+					})
+				}
+			: undefined
+	)
+
 	const tree = $derived<DrillNode<PreviewTarget>[]>([
 		pagesBranch,
 		...(artifactsBranch ? [artifactsBranch] : []),
+		...(pipelinesBranch ? [pipelinesBranch] : []),
 		...tagItems(
 			buildWorkspaceTree({
 				loaded: loader.loaded,
diff --git a/frontend/src/lib/components/sessions/PreviewTabHost.svelte b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
index 314b6a80b2..7c3a48f5d6 100644
--- a/frontend/src/lib/components/sessions/PreviewTabHost.svelte
+++ b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
@@ -354,7 +354,10 @@
 					{#await import('./PipelineEditorView.svelte')}
 						{@render editorLoading()}
 					{:then Module}
-						<Module.default {runtime} path={itemPath} {workspaceId} {isActiveSession} {active} />
+						<!-- Keyed: the view binds one folder's state for its lifetime. -->
+						{#key itemPath}
+							<Module.default {runtime} path={itemPath} {workspaceId} {isActiveSession} {active} />
+						{/key}
 					{/await}
 				{:else}
 					{#await import('./RawAppEditorView.svelte')}
@@ -365,6 +368,7 @@
 							path={itemPath}
 							{workspaceId}
 							{onNavigate}
+							onSeeDetails={seeDetails}
 							{isActiveSession}
 							{active}
 							{newRawApp}
diff --git a/frontend/src/lib/components/sessions/RawAppEditorView.svelte b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
index 137055204d..de05359bd5 100644
--- a/frontend/src/lib/components/sessions/RawAppEditorView.svelte
+++ b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
@@ -33,6 +33,7 @@
 		path,
 		workspaceId,
 		onNavigate,
+		onSeeDetails,
 		isActiveSession = true,
 		active = true,
 		newRawApp = false
@@ -41,6 +42,9 @@
 		path: string
 		workspaceId: string
 		onNavigate?: (item: WorkspaceItem) => void
+		/** `Exit & see details` — flips this tab to the item's deployed view rather than
+		 * navigating out of the session. */
+		onSeeDetails?: (e: { path: string }) => void
 		/** Forwarded to SessionEditorTarget — only the visible session claims the
 		 * workspace's single live-editor slot. */
 		isActiveSession?: boolean
@@ -357,6 +361,7 @@
 				newApp={!cell.saved.val || cell.saved.val.no_deployed === true}
 				{diffDrawer}
 				{onNavigate}
+				onDetails={onSeeDetails}
 				condensedHeader={true}
 				onResetToDeployed={reloadDeployed}
 				onDeploy={(e) => runtime.itemDeployed(workspaceId, 'raw_app', path, e.path)}
diff --git a/frontend/src/lib/components/sessions/SessionChangesBar.svelte b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
index 140300ea30..3929b78ca9 100644
--- a/frontend/src/lib/components/sessions/SessionChangesBar.svelte
+++ b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
@@ -22,7 +22,7 @@
 	import { badgeCounts, badgeOf, buildDeployItems, type DeployItem } from './sessionDeployModel'
 	import { useExistingMaskKeys } from './sessionDeployModel.svelte'
 	import { previewTargetForDeployKind } from './sessionPreviewTabs.svelte'
-	import { pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
+	import { PIPELINE_DRAFT_KIND, pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
 	import type { PreviewTarget } from './previewRouter'
 	import JobsSegment from '$lib/components/copilot/chat/JobsSegment.svelte'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
@@ -378,6 +378,11 @@
 		onDataChanged={refreshDock}
 		onItemDeployed={(item) =>
 			void runtime?.manager.renameModifiedItem(item.draftKind, item.path, item.displayPath)}
-		onItemDiscarded={(item) => void runtime?.manager.removeModifiedItem(item.draftKind, item.path)}
+		onItemDiscarded={(item) => {
+			void runtime?.manager.removeModifiedItem(item.draftKind, item.path)
+			const folder = pipelineFolderFromBundlePath(item.path)
+			if (item.draftKind === PIPELINE_DRAFT_KIND && folder) void runtime?.forgetPipelineDrafts(folder)
+		}}
+		deployPipeline={runtime?.deployPipeline}
 	/>
 {/if}
diff --git a/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte b/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte
index fe5ab2d199..d921e435b0 100644
--- a/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte
+++ b/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte
@@ -2,10 +2,10 @@
 	import WorkspaceDiffDrawer from './WorkspaceDiffDrawer.svelte'
 	import { ArrowRight, GitFork, Pencil } from 'lucide-svelte'
 	import { userWorkspaces } from '$lib/stores'
-	import Badge from '$lib/components/common/badge/Badge.svelte'
-	import { devBadgeText } from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 	import { useSessionDeployModel } from './sessionDeployModel.svelte'
 	import type { DeployItem } from './sessionDeployModel'
+	import type { DeployResult } from '$lib/utils_workspace_deploy'
 
 	// Session "Edits" drawer. Builds the deploy model over the session
 	// workspace's drafts and hands it to WorkspaceDiffDrawer, which renders the
@@ -19,7 +19,8 @@
 		keys,
 		onDataChanged,
 		onItemDeployed,
-		onItemDiscarded
+		onItemDiscarded,
+		deployPipeline
 	}: {
 		workspaceId: string
 		parentWorkspaceId?: string
@@ -36,6 +37,8 @@
 		 *  drops it. */
 		onItemDeployed?: (item: DeployItem) => void
 		onItemDiscarded?: (item: DeployItem) => void
+		/** Forwarded to the deploy model: deploys a pipeline folder's draft bundle. */
+		deployPipeline?: (folder: string) => Promise<DeployResult>
 	} = $props()
 
 	const isFork = $derived(!!parentWorkspaceId)
@@ -51,7 +54,8 @@
 		mask: keys,
 		onDataChanged,
 		onItemDeployed,
-		onItemDiscarded
+		onItemDiscarded,
+		deployPipeline
 	}))
 
 	// Editor URL for a row (every item lives in the session workspace).
@@ -95,7 +99,7 @@
 					{ws?.name ?? workspaceId}
 				</span>
 				{#if ws?.is_dev_workspace}
-					<Badge color="indigo" small>{devBadgeText(ws.dev_workspace_label)}</Badge>
+					<DevWorkspaceBadge label={ws.dev_workspace_label} color={ws.color} fallbackColor="indigo" />
 				{/if}
 				<ArrowRight class="w-3 h-3 shrink-0 text-tertiary" />
 				<span class="font-medium truncate" title={parentWs?.name ?? parentWorkspaceId}>
diff --git a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
index 9a7fb20bd6..a14990583d 100644
--- a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
+++ b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
@@ -69,7 +69,7 @@
 			iconOnly={isCollapsed}
 			tooltip={isCollapsed ? 'Workspace' : undefined}
 			size="sm"
-			class="w-full justify-center"
+			class="w-full justify-center whitespace-nowrap"
 			onActivate={onNavActivate}
 		/>
 		<ToggleButton
@@ -80,7 +80,7 @@
 			iconOnly={isCollapsed}
 			tooltip={isCollapsed ? 'AI Sessions (beta)' : undefined}
 			size="sm"
-			class="w-full justify-center"
+			class="w-full justify-center whitespace-nowrap"
 		/>
 	{/snippet}
 </ToggleButtonGroup>
diff --git a/frontend/src/lib/components/sessions/SessionPicker.svelte b/frontend/src/lib/components/sessions/SessionPicker.svelte
index 9707b537b4..d4f7fa66ab 100644
--- a/frontend/src/lib/components/sessions/SessionPicker.svelte
+++ b/frontend/src/lib/components/sessions/SessionPicker.svelte
@@ -2,7 +2,7 @@
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
 	import Modal from '$lib/components/common/modal/Modal.svelte'
 	import Checkbox from '$lib/components/common/checkbox/Checkbox.svelte'
-	import { Badge, Button } from '$lib/components/common'
+	import { Button } from '$lib/components/common'
 	import {
 		Archive,
 		ArchiveRestore,
@@ -67,7 +67,7 @@
 	import { currentWorkspaceRootId, workspaceRootId } from './sessionScope.svelte'
 	import { page } from '$app/state'
 	import { base } from '$app/paths'
-	import { devBadgeText } from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 	import {
 		dateBucket,
 		GROUP_BY_OPTIONS,
@@ -1220,9 +1220,12 @@
 									{group.label}
 								</span>
 								{#if groupWs?.is_dev_workspace}
-									<Badge color="gray" small class="text-3xs px-1 py-0 shrink-0">
-										{devBadgeText(groupWs.dev_workspace_label)}
-									</Badge>
+									<DevWorkspaceBadge
+										label={groupWs.dev_workspace_label}
+										color={groupWs.color}
+										fallbackColor="gray"
+										class="text-3xs px-1 py-0 shrink-0"
+									/>
 								{/if}
 								{#if groupWsId}
 									<Button
@@ -1335,8 +1338,8 @@
 	bind:open={seedOfferOpen}
 	kind="X"
 	enterConfirms={false}
-	title="Keep this {seedOffer?.route.kind ?? 'item'} in the new session?"
-	description="You came here from {seedOffer?.route.itemPath ?? ''}."
+	title="Keep this {seedOffer?.kind ?? 'item'} in the new session?"
+	description="You came here from {seedOffer?.path ?? ''}."
 >
 	<p class="text-sm text-secondary">
 		Keeping it opens it in the preview, so the chat starts with it as context.
diff --git a/frontend/src/lib/components/sessions/SessionWrapper.svelte b/frontend/src/lib/components/sessions/SessionWrapper.svelte
index 3335de3d33..af00454f81 100644
--- a/frontend/src/lib/components/sessions/SessionWrapper.svelte
+++ b/frontend/src/lib/components/sessions/SessionWrapper.svelte
@@ -3,7 +3,8 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import AIChat from '$lib/components/copilot/chat/AIChat.svelte'
 	import EditableInput from '$lib/components/common/EditableInput.svelte'
-	import { Button, NameIdTooltip } from '$lib/components/common'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { Button } from '$lib/components/common'
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import { AIChatManager } from '$lib/components/copilot/chat/AIChatManager.svelte'
@@ -17,17 +18,12 @@
 	import {
 		Archive,
 		ArchiveRestore,
-		ArrowUpRight,
 		EllipsisVertical,
-		ExternalLink,
 		MessageSquareDashed,
 		Pencil,
-		Settings,
 		Trash2,
 		X
 	} from 'lucide-svelte'
-	import { type Item } from '$lib/utils'
-	import WorkspaceScopeTrigger from '$lib/components/WorkspaceScopeTrigger.svelte'
 	import SessionWorkspaceBar from './SessionWorkspaceBar.svelte'
 	import SessionChangesBar from './SessionChangesBar.svelte'
 	import { clearSessionRecovered, isSessionRecovered } from './sessionRecoveryNotice.svelte'
@@ -53,17 +49,15 @@
 	} from './sessionState.svelte'
 	import { getOrCreateRuntime, removeSession } from './sessionRuntime.svelte'
 	import { goto } from '$lib/navigation'
-	import { base } from '$app/paths'
 	import { splitterPointerCapture } from '$lib/utils/splitterPointerCapture'
 
-	// headerInset: extra left padding on the chat header so it clears a floating
-	// control (the collapsed-rail launcher) sitting at the screen's top-left.
 	let {
 		sessionId,
-		headerInset = false
+		headerInPage = false
 	}: {
 		sessionId: string
-		headerInset?: boolean
+		/** True for the session the page is showing: its header rides the page header bar. */
+		headerInPage?: boolean
 	} = $props()
 
 	// Parent keys by sessionId; this wrapper only mounts when the session exists.
@@ -112,34 +106,9 @@
 		})
 	})
 
-	// The workspace the session acts on, shown in the header "Acting on" strip via the shared
-	// WorkspaceScopeTrigger chip. `targetId` is also the workspace the chip's ellipsis menu targets.
-	const acting = $derived.by(() => {
-		const wsId = session ? getEffectiveWorkspaceId(session) : undefined
-		if (!wsId) return undefined
-		const name = $userWorkspaces.find((w) => w.id === wsId)?.name ?? wsId
-		return { targetId: wsId, name }
-	})
-
-	// Ellipsis menu on the "Acting on" chip. Both entries are real links (so
-	// modifier/middle clicks open a new tab); the `workspace` query param
-	// points the navigation at the acting workspace — the layout applies it on
-	// both full loads and client-side query changes. The trailing external-link
-	// glyphs make the leave-the-session navigation explicit.
-	const actingMenu = $derived<Item[]>([
-		{
-			displayName: 'Workspace settings',
-			icon: Settings,
-			href: `${base}/workspace_settings?workspace=${acting?.targetId ?? ''}`,
-			extra: externalLinkHint
-		},
-		{
-			displayName: 'Go to this workspace',
-			icon: ArrowUpRight,
-			href: `${base}/?workspace=${acting?.targetId ?? ''}`,
-			extra: externalLinkHint
-		}
-	])
+	// The workspace the session acts on. The page header's breadcrumb scopes itself to it, so a
+	// session running in a fork reads as that fork rather than as the navigation workspace.
+	const actingWorkspaceId = $derived(session ? getEffectiveWorkspaceId(session) : undefined)
 
 	// Load copilot config (models, providers) for the workspace the session acts
 	// on, not the navigation workspace — a session deliberately leaves
@@ -150,7 +119,7 @@
 	// otherwise race to clobber the active chat's model config.
 	$effect(() => {
 		if (sessionState.currentSessionId !== sessionId) return
-		const ws = acting?.targetId ?? $workspaceStore
+		const ws = actingWorkspaceId ?? $workspaceStore
 		if (ws) {
 			loadCopilot(ws)
 		}
@@ -334,10 +303,6 @@
 		'flex flex-row items-center justify-between gap-2 py-2 px-3 text-xs border rounded-md'
 </script>
 
-{#snippet externalLinkHint()}
-	<ExternalLink size={12} class="shrink-0 text-tertiary" />
-{/snippet}
-
 {#if !session || !runtime}
 	<div class="p-8 text-secondary text-sm">Session not found</div>
 {:else}
@@ -411,95 +376,81 @@
 	     sessions have their own empty-state affordances above. -->
 	{#snippet sessionEmptyHint()}{/snippet}
 
+	{#snippet sessionHeader()}
+		<EditableInput
+			bind:this={summaryInput}
+			value={session.summary ?? ''}
+			placeholder="Untitled session"
+			onSave={(v) => renameSession(session.id, v)}
+			class="text-xs font-normal"
+			inputClass="!text-xs !font-normal"
+		/>
+
+		<DropdownV2
+			fixedHeight={false}
+			placement="bottom-start"
+			enableFlyTransition
+			items={[
+				{
+					displayName: 'Rename',
+					icon: Pencil,
+					action: () => summaryInput?.edit()
+				},
+				...(session.archived
+					? // No Unarchive when the workspace is gone — it can't persist
+						// (putSession guard) and reconcile would re-archive it.
+						isUnavailable
+						? []
+						: [
+								{
+									displayName: 'Unarchive',
+									icon: ArchiveRestore,
+									action: () => setSessionArchived(session.id, false)
+								}
+							]
+					: [
+							{
+								displayName: 'Archive',
+								icon: Archive,
+								action: () => archiveAndReset()
+							}
+						]),
+				{
+					displayName: 'Delete',
+					icon: Trash2,
+					type: 'delete',
+					action: () => (deleteConfirmOpen = true)
+				}
+			]}
+		>
+			{#snippet buttonReplacement()}
+				<span
+					class="inline-flex items-center justify-center w-5 h-5 rounded text-tertiary hover:bg-surface-hover hover:text-primary"
+					title="More"
+				>
+					<EllipsisVertical size={14} />
+				</span>
+			{/snippet}
+		</DropdownV2>
+	{/snippet}
+
+	{#if headerInPage}
+		<!-- The chat's own header row is the page header on this route: the session's name is its
+		     breadcrumb, and the menu is its action. The workspace it acts on is named by the
+		     breadcrumb's own workspace part, the way every other route names it — a session in a
+		     fork reads like anything else in that fork. -->
+		<PageHeaderContent
+			section={{ label: session.summary ?? 'Untitled session', content: sessionHeader }}
+			{actingWorkspaceId}
+		/>
+	{/if}
+
 	<!-- The wrapper contributes only the chat column; edited items are shown in the
 	     page's preview tabs (PreviewTabHost) beside it, not a second pane here. The
 	     single Pane fills 100% (no explicit `size`, so Splitpanes auto-distributes). -->
 	<div class="flex-1 min-h-0 flex flex-col" use:splitterPointerCapture>
 		<Splitpanes horizontal={false} class="flex-1 min-h-0 splitter-hidden">
 			<Pane minSize={25} class="flex flex-col min-h-0 pb-2">
-				<header
-					class="flex flex-row items-center gap-1 {headerInset
-						? 'pl-11'
-						: 'pl-4'} pr-4 py-2 shrink-0"
-				>
-					<EditableInput
-						bind:this={summaryInput}
-						value={session.summary ?? ''}
-						placeholder="Untitled session"
-						onSave={(v) => renameSession(session.id, v)}
-						class="text-sm font-semibold"
-						inputClass="!text-sm !font-semibold"
-					/>
-					<DropdownV2
-						fixedHeight={false}
-						placement="bottom-start"
-						enableFlyTransition
-						items={[
-							{
-								displayName: 'Rename',
-								icon: Pencil,
-								action: () => summaryInput?.edit()
-							},
-							...(session.archived
-								? // No Unarchive when the workspace is gone — it can't persist
-									// (putSession guard) and reconcile would re-archive it.
-									isUnavailable
-									? []
-									: [
-											{
-												displayName: 'Unarchive',
-												icon: ArchiveRestore,
-												action: () => setSessionArchived(session.id, false)
-											}
-										]
-								: [
-										{
-											displayName: 'Archive',
-											icon: Archive,
-											action: () => archiveAndReset()
-										}
-									]),
-							{
-								displayName: 'Delete',
-								icon: Trash2,
-								type: 'delete',
-								action: () => (deleteConfirmOpen = true)
-							}
-						]}
-					>
-						{#snippet buttonReplacement()}
-							<span
-								class="inline-flex items-center justify-center w-5 h-5 rounded text-tertiary hover:bg-surface-hover hover:text-primary"
-								title="More"
-							>
-								<EllipsisVertical size={14} />
-							</span>
-						{/snippet}
-					</DropdownV2>
-					{#if acting && hasFirstUserMessage}
-						<!-- "Acting on" context: workspace root (avatar + name) and, when the
-					     session runs in a fork, the fork name (accent pill) — with a button
-					     to jump into that workspace. Compact; sits right after the title.
-					     Hidden until the session has started — a new (un-sent) session shows
-					     the "Run in" picker (SessionWorkspaceBar) instead. -->
-						<div class="flex items-center gap-1 min-w-0 text-2xs text-tertiary">
-							<span class="shrink-0">Acting on</span>
-							<!-- Hover reveals the workspace name + id + copy button (shared
-							     NameIdTooltip, same as the sidebar family picker), so the chip
-							     carries the copy affordance without an inline button. -->
-							<NameIdTooltip name={acting.name} id={acting.targetId}>
-								<WorkspaceScopeTrigger
-									workspaceId={acting.targetId}
-									showChevron={false}
-									interactive={false}
-									disableTitle
-									class="max-w-[16rem]"
-									menuItems={actingMenu}
-								/>
-							</NameIdTooltip>
-						</div>
-					{/if}
-				</header>
 				<div class="flex-1 min-h-0 w-full flex flex-col {hasFirstUserMessage ? '' : 'pt-8'}">
 					<AIChat
 						bind:this={aiChat}
diff --git a/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte b/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
index 6501dc8d3e..f5b7e8d34f 100644
--- a/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
+++ b/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
@@ -32,8 +32,9 @@
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import InputError from '$lib/components/InputError.svelte'
 	import PrefixedInput from '$lib/components/PrefixedInput.svelte'
-	import { Badge, Button, CopyButton } from '$lib/components/common'
-	import { devBadgeText, devLabelNoun } from '$lib/utils/devWorkspaceLabel'
+	import { Button, CopyButton } from '$lib/components/common'
+	import { devLabelNoun } from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 	import Select from '../select/Select.svelte'
 	import { Building, Check, GitFork, Plus, Settings } from 'lucide-svelte'
 
@@ -448,12 +449,12 @@
 								>{f.name}</span
 							>
 							{#if f.is_dev_workspace}
-								<Badge
-									color="dark-blue"
-									small
-									class="text-3xs px-1 py-0 dark:bg-surface-accent-primary text-white dark:text-white"
-									>{devBadgeText(f.dev_workspace_label)}</Badge
-								>
+								<DevWorkspaceBadge
+									label={f.dev_workspace_label}
+									color={f.color}
+									fallbackClass="dark:bg-surface-accent-primary text-white dark:text-white"
+									class="text-3xs px-1 py-0"
+								/>
 							{/if}
 							{#if isSelected(f.id)}
 								<Check size={14} class="shrink-0 ml-auto text-accent" />
diff --git a/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts b/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts
index 6cad6121cd..e5f4ff9873 100644
--- a/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts
+++ b/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts
@@ -62,6 +62,12 @@ describe('diffInMask', () => {
 		expect(diffInMask(diff('script', 'u/me/s'), mask)).toBe(true)
 	})
 
+	it('selects only the scripts a masked pipeline deployed, not the rest of its folder', () => {
+		const mask = new Set(['data_pipeline:f/crm/data_pipeline', 'script:f/crm/clean'])
+		expect(diffInMask(diff('script', 'f/crm/clean'), mask)).toBe(true)
+		expect(diffInMask(diff('script', 'f/crm/unrelated'), mask)).toBe(false)
+	})
+
 	it('matches a legacy app diff under both its identity and bridged mask keys', () => {
 		expect(diffInMask(diff('app', 'u/me/legacy'), new Set(['app:u/me/legacy']))).toBe(true)
 		expect(diffInMask(diff('app', 'u/me/legacy'), new Set(['raw_app:u/me/legacy']))).toBe(true)
diff --git a/frontend/src/lib/components/sessions/modifiedItemsMask.ts b/frontend/src/lib/components/sessions/modifiedItemsMask.ts
index 7d0d3abbae..d597c46ec9 100644
--- a/frontend/src/lib/components/sessions/modifiedItemsMask.ts
+++ b/frontend/src/lib/components/sessions/modifiedItemsMask.ts
@@ -1,4 +1,5 @@
 import type { UserDraftItemKind, WorkspaceItemDiff } from '$lib/gen'
+import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
 
 // The "modified items mask" tracks which workspace items an AI chat touched via
 // tool calls. Each key is `${UserDraftItemKind}:${storagePath}`. UserDraftItemKind
@@ -45,6 +46,21 @@ export function forkDiffKindToUserDraftKind(kind: ForkDiffKind): UserDraftItemKi
 	return FORK_DIFF_KIND_TO_USER_DRAFT_KIND[kind]
 }
 
+// A pipeline the chat edited is masked as its folder's draft bundle, and each
+// script that bundle deploys is masked too, so a fork review selects exactly
+// those. The session's changes list shows deployed scripts of a masked
+// pipeline's folder as that pipeline's one row — any of them, since a script's
+// mask entry does not say whether a pipeline deploy or the chat put it there.
+export function foldedIntoPipelineRow(
+	mask: ReadonlySet<string>,
+	kind: UserDraftItemKind,
+	path: string
+): boolean {
+	if (kind !== 'script') return false
+	const folder = path.match(/^f\/([^/]+)\//)?.[1]
+	return !!folder && mask.has(maskKey(PIPELINE_DRAFT_KIND, pipelineBundlePath(folder)))
+}
+
 // True when a fork-comparison diff names an item present in the chat-modified mask.
 export function diffInMask(diff: WorkspaceItemDiff, mask: Set<string>): boolean {
 	const kind = forkDiffKindToUserDraftKind(diff.kind)
diff --git a/frontend/src/lib/components/sessions/openInSessionContext.ts b/frontend/src/lib/components/sessions/openInSessionContext.ts
index ddecb01b4f..af1a5113ad 100644
--- a/frontend/src/lib/components/sessions/openInSessionContext.ts
+++ b/frontend/src/lib/components/sessions/openInSessionContext.ts
@@ -1,6 +1,6 @@
 import { getContext, onDestroy, setContext } from 'svelte'
 import type { OpenInSessionSource } from './OpenInSessionButton.svelte'
-import type { PreviewItemRoute } from './previewPaths'
+import type { SessionTarget } from './sessionState.svelte'
 
 // The "Open in AI session" hand-off, published by the component that owns the
 // item being edited (FlowBuilder, RawAppEditor) for AI entry points too deep in
@@ -38,20 +38,17 @@ export function getOpenInSessionHandoff(): OpenInSessionHandoff | undefined {
 	return getContext<OpenInSessionHandoff | undefined>(KEY)
 }
 
-/** The mounted editor's hand-off for the item `route` names, or undefined when
- * no editor on screen publishes one for it (a legacy app, a detail page).
- * Matched on the item rather than taken as "the latest registered": a script
- * editor mounted in a flow's drawer registers too, and the rail wants the
- * page's own item. */
+/** The mounted editor's hand-off for `target`, or undefined when no editor on
+ * screen publishes one for it (a detail page). Matched on the item rather than
+ * taken as "the latest registered": a script editor mounted in a flow's drawer
+ * registers too, and the rail wants the page's own item. */
 export function findMountedOpenInSessionSource(
-	route: PreviewItemRoute
+	target: SessionTarget
 ): OpenInSessionSource | undefined {
-	const kind = route.kind === 'app' ? (route.raw_app ? 'raw_app' : undefined) : route.kind
-	if (!kind) return undefined
 	for (const handoff of mounted) {
 		const source = handoff.source()
-		const target = source?.target
-		if (target && target.kind === kind && target.path === route.itemPath) return source
+		const t = source?.target
+		if (t && t.kind === target.kind && t.path === target.path) return source
 	}
 	return undefined
 }
diff --git a/frontend/src/lib/components/sessions/previewPaths.ts b/frontend/src/lib/components/sessions/previewPaths.ts
index 10ad5b00ef..497db44ff6 100644
--- a/frontend/src/lib/components/sessions/previewPaths.ts
+++ b/frontend/src/lib/components/sessions/previewPaths.ts
@@ -1,5 +1,6 @@
 import { base } from '$lib/base'
 import type { WorkspaceItemKind } from '$lib/components/workspacePicker'
+import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 
 // The paths a preview location can point at, and the base handling around them. Kept apart
 // from `previewRouter`, which reads a location's *view* from each page's filter schema and
@@ -186,3 +187,11 @@ export function parseHistoricalScriptEdit(url: string): { path: string; hash: st
 	const hash = new URL(url, 'http://x').searchParams.get('hash')
 	return hash ? { path: route.itemPath, hash } : null
 }
+
+// A `/pipeline/<folder>` route is the data-pipeline graph editor for that folder
+// (the folder is a single path segment, not a workspace item path). The bare
+// `/pipeline` list page is not an editor. Returns the folder name, or null.
+export function parsePipelineRoute(fullPath: string): string | null {
+	const m = stripBase(fullPath).match(/^\/pipeline\/([^/?#]+)/)
+	return m ? normalizePipelineFolder(decodeURIComponent(m[1])) : null
+}
diff --git a/frontend/src/lib/components/sessions/previewRouter.ts b/frontend/src/lib/components/sessions/previewRouter.ts
index 6614adfe80..ae3b407070 100644
--- a/frontend/src/lib/components/sessions/previewRouter.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.ts
@@ -11,6 +11,7 @@ import {
 	pageKey,
 	pageHref,
 	parsePageItemRoute,
+	parsePipelineRoute,
 	parseHistoricalScriptEdit,
 	parsePreviewItemRoute,
 	RESOURCES_PATH,
@@ -35,6 +36,7 @@ export {
 	pageHref,
 	parseHistoricalScriptEdit,
 	parsePageItemRoute,
+	parsePipelineRoute,
 	parsePreviewItemRoute,
 	stripBase,
 	TRIGGER_PAGES,
@@ -63,7 +65,6 @@ import { buildVariablesFilterSchema } from '$lib/components/variables/variablesF
 import { buildResourcesFilterSchema } from '$lib/components/resources/resourcesFilter'
 import { buildAssetsFilterSchema } from '$lib/components/assets/assetsFilter'
 import { COMPARE_ITEMS_PARAM } from './modifiedItemsMask'
-import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 import type { WorkspaceItem } from '$lib/components/workspacePicker'
 import type { SessionTargetKind } from './sessionRuntime.svelte'
 
@@ -502,13 +503,6 @@ export function parsePreviewSelectedId(url: string): string | undefined {
 	}
 }
 
-// A `/pipeline/<folder>` route is the data-pipeline graph editor for that folder
-// (the folder is a single path segment, not a workspace item path). The bare
-// `/pipeline` list page is not an editor. Returns the folder name, or null.
-export function parsePipelineRoute(fullPath: string): string | null {
-	const m = stripBase(fullPath).match(/^\/pipeline\/([^/?#]+)/)
-	return m ? normalizePipelineFolder(decodeURIComponent(m[1])) : null
-}
 
 // The id (before the query) is the artifact's stable routing identity; the name rides in the
 // hash so the tab strip labels it without a store lookup, and the version in the query so the
@@ -562,9 +556,9 @@ export const isArtifactKey = (key: string) => key.startsWith('artifact:')
 // How a preview tab should render: as an in-process live editor, the deployed
 // item's view page, or an iframe fallback. An item of a wrappable kind (script,
 // flow, raw app) mounts its per-(kind,path) cell editor on `/edit/` and its viewer
-// on `/get/`; a `/pipeline/<folder>` route mounts the data-pipeline graph editor
-// (single, shared runtime.pipelineEditorState — `path` is the folder); the list page
-// of a page item kind mounts that list; everything
+// on `/get/`; a `/pipeline/<folder>` route mounts the data-pipeline graph editor of
+// that folder (`path` is the folder); the list page of a page item kind mounts that
+// list; everything
 // else (static pages, regular drag-and-drop apps, any other route) stays an iframe.
 export type PreviewSlot =
 	| { kind: 'editor'; editorKind: SessionTargetKind | 'pipeline'; path: string }
diff --git a/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts b/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts
index 981b4cc752..a99d38ee96 100644
--- a/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts
@@ -27,6 +27,8 @@ import {
 import { maskKey } from './modifiedItemsMask'
 import { sessionState } from './sessionState.svelte'
 import { logFeatureUsage } from '$lib/utils/featureUsage'
+import { AssetService } from '$lib/gen'
+import { PIPELINE_DRAFT_KIND, pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
 
 export type DeploymentStatus = { status: 'loading' | 'failed'; error?: string }
 
@@ -52,6 +54,9 @@ export interface SessionDeployModelArgs {
 	onItemDiscarded?: (item: DeployItem) => void
 	/** Chat-modified-items mask; undefined shows every draft. */
 	mask?: Set<string>
+	/** Deploys a pipeline folder's draft bundle, which no per-item deploy can: it
+	 *  expands into the folder's scripts and triggers. */
+	deployPipeline?: (folder: string) => Promise<DeployResult>
 }
 
 export interface DiffValues {
@@ -59,6 +64,15 @@ export interface DiffValues {
 	after: unknown
 }
 
+// A pipeline has no row of its own: it exists while its folder holds pipeline scripts.
+async function itemExists(kind: Kind, path: string, workspace: string): Promise<boolean> {
+	if (kind !== PIPELINE_DRAFT_KIND) return checkItemExists(kind, path, workspace)
+	const folder = pipelineFolderFromBundlePath(path)
+	if (!folder) return false
+	const pipelines = await AssetService.listPipelineFolders({ workspace })
+	return pipelines.some((p) => p.folder === folder)
+}
+
 /** Resolves which mask-only candidates still exist in the session workspace
  *  (deployed) vs are gone (discarded drafts / deleted items) — the
  *  `existingKeys` input of `buildDeployItems`. Undefined while resolving, so
@@ -100,7 +114,7 @@ export function useExistingMaskKeys(
 			// workspace; a discarded or deleted one doesn't.
 			void Promise.all(
 				cands.map((c) =>
-					checkItemExists(c.deployKind, c.path, workspaceId)
+					itemExists(c.deployKind, c.path, workspaceId)
 						.then((exists) => (exists ? c.key : null))
 						.catch(() => null)
 				)
@@ -246,11 +260,18 @@ export function useSessionDeployModel(getArgs: () => SessionDeployModelArgs) {
 	async function runPlan(entry: DeployPlanEntry): Promise<DeployResult> {
 		const cur = getArgs().workspaceId
 		switch (entry.op) {
-			case 'deploy_draft':
+			case 'deploy_draft': {
+				const folder =
+					entry.draftKind === PIPELINE_DRAFT_KIND
+						? pipelineFolderFromBundlePath(entry.path)
+						: undefined
+				const deployPipeline = getArgs().deployPipeline
+				if (folder && deployPipeline) return deployPipeline(folder)
 				return deployDraft(entry.draftKind, entry.path, cur, {
 					draftOnly: entry.draftOnly,
 					rawApp: entry.rawApp
 				})
+			}
 			case 'discard':
 				return discardDraft(entry.draftKind, entry.path, cur, entry.draftOnly, entry.legacy)
 		}
@@ -314,6 +335,16 @@ export function useSessionDeployModel(getArgs: () => SessionDeployModelArgs) {
 
 	// ── Diff values (one resolver for tree + column) ─────────────────────────
 	async function loadDiffValues(item: DeployItem): Promise<DiffValues> {
+		const pipelineFolder =
+			item.draftKind === PIPELINE_DRAFT_KIND ? pipelineFolderFromBundlePath(item.path) : undefined
+		if (pipelineFolder) {
+			// Dynamic: the pipeline deploy module reaches every trigger kind's save utils.
+			const { loadPipelineDraftDiff } = await import(
+				'$lib/components/assets/AssetGraph/pipelineDeploy.svelte'
+			)
+			if (item.hasDraft) return loadPipelineDraftDiff(getArgs().workspaceId, pipelineFolder)
+			return { before: undefined, after: undefined }
+		}
 		const base = diffBaseFor(item, getArgs().workspaceId)
 		if (base.kind === 'draft') {
 			const { deployed, draft } = await getDraftDiffValues(
diff --git a/frontend/src/lib/components/sessions/sessionDeployModel.test.ts b/frontend/src/lib/components/sessions/sessionDeployModel.test.ts
index 7fa4e3cca8..ee2a4115da 100644
--- a/frontend/src/lib/components/sessions/sessionDeployModel.test.ts
+++ b/frontend/src/lib/components/sessions/sessionDeployModel.test.ts
@@ -101,6 +101,15 @@ describe('buildDeployItems', () => {
 		expect(items[0].hasDraft).toBe(true)
 	})
 
+	it("a pipeline's deployed scripts fold into its one row", () => {
+		const bundle = maskKey('data_pipeline', 'f/crm/data_pipeline')
+		const node = maskKey('script', 'f/crm/clean')
+		const mask = new Set([bundle, node])
+		const items = buildDeployItems({ draftItems: [], mask, existingKeys: new Set([bundle, node]) })
+		expect(items.map((i) => i.key)).toEqual([bundle])
+		expect(maskOnlyCandidates({ draftItems: [], mask }).map((c) => c.key)).toEqual([bundle])
+	})
+
 	it('maskOnlyCandidates returns keys not covered by a draft', () => {
 		const cands = maskOnlyCandidates({
 			draftItems: [draft('script', 'u/a/draft')],
diff --git a/frontend/src/lib/components/sessions/sessionDeployModel.ts b/frontend/src/lib/components/sessions/sessionDeployModel.ts
index d38de06c86..4933f3a64a 100644
--- a/frontend/src/lib/components/sessions/sessionDeployModel.ts
+++ b/frontend/src/lib/components/sessions/sessionDeployModel.ts
@@ -1,7 +1,7 @@
 import type { UserDraftItemKind } from '$lib/gen'
 import type { DraftItem } from '$lib/workspaceDrafts.svelte'
 import type { Kind } from '$lib/utils_deployable'
-import { maskKey } from './modifiedItemsMask'
+import { foldedIntoPipelineRow, maskKey } from './modifiedItemsMask'
 
 // Unified item model for the session Review & Deploy surface. This is the pure,
 // UI-free core: every item the session touched is either a pending **draft** or
@@ -128,6 +128,7 @@ export function buildDeployItems(input: BuildInput): DeployItem[] {
 			if (sep < 0) continue
 			const udk = k.slice(0, sep) as UserDraftItemKind
 			const path = k.slice(sep + 1)
+			if (foldedIntoPipelineRow(mask, udk, path)) continue
 			seen.add(k)
 			out.push({
 				key: k,
@@ -172,6 +173,7 @@ export function maskOnlyCandidates(
 		if (sep < 0) continue
 		const udk = k.slice(0, sep) as UserDraftItemKind
 		const path = k.slice(sep + 1)
+		if (foldedIntoPipelineRow(mask, udk, path)) continue
 		out.push({ key: k, draftKind: udk, deployKind: deployKindOf(udk, udk === 'raw_app'), path })
 	}
 	return out
diff --git a/frontend/src/lib/components/sessions/sessionMode.svelte.ts b/frontend/src/lib/components/sessions/sessionMode.svelte.ts
index a2c20e08a8..d8724f8273 100644
--- a/frontend/src/lib/components/sessions/sessionMode.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionMode.svelte.ts
@@ -1,9 +1,13 @@
 import { base } from '$app/paths'
 import type { SessionTarget } from './sessionState.svelte'
+import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 
 // Maps a session's editor target to the canonical full-page Windmill route.
 export function sessionTargetHref(target: SessionTarget | undefined): string | undefined {
 	if (!target) return undefined
+	if (target.kind === 'pipeline') {
+		return `${base}/pipeline/${encodeURIComponent(normalizePipelineFolder(target.path))}`
+	}
 	const seg =
 		target.kind === 'script'
 			? 'scripts/edit'
@@ -47,6 +51,30 @@ export function withMenuHidden(url: string, workspaceId?: string): string {
 	}
 }
 
+// Remembers `nomenubar` for the rest of this iframe's life. Navigating inside a preview drops
+// the query param (client-side routing and full loads both), and the global nav must not pop
+// back in. sessionStorage so it survives a reload within the frame; the top window never writes
+// it, so an ordinary tab and the oauth callback still toggle normally.
+export function rememberMenuHidden(url: URL): void {
+	if (typeof window === 'undefined' || window.self === window.top) return
+	if (url.searchParams.get('nomenubar') !== 'true') return
+	try {
+		sessionStorage.setItem('nomenubar_embedded', 'true')
+	} catch {}
+}
+
+// Whether this page is shown without the workspace navigation. The layout drops the sidebar and
+// the band's trail, so a page whose only control lives in the band has to carry it itself — see
+// InWorkspaceAppViewer's Edit button. Read this rather than the raw query param: a preview tab
+// that has navigated no longer carries it.
+export function isMenuHidden(url: URL): boolean {
+	return (
+		url.searchParams.get('nomenubar') === 'true' ||
+		url.pathname.startsWith('/oauth/callback/') ||
+		isSessionPreviewFrame()
+	)
+}
+
 // True when this window is a sessions-preview iframe: embedded, with the `nomenubar` flag
 // the preview always sets and the logged layout stickies into sessionStorage.
 export function isSessionPreviewFrame(): boolean {
diff --git a/frontend/src/lib/components/sessions/sessionMode.test.ts b/frontend/src/lib/components/sessions/sessionMode.test.ts
index 9bc67b9a58..75d3445fed 100644
--- a/frontend/src/lib/components/sessions/sessionMode.test.ts
+++ b/frontend/src/lib/components/sessions/sessionMode.test.ts
@@ -13,9 +13,13 @@ describe('sessionTargetHref', () => {
 		expect(sessionTargetHref({ kind: 'raw_app', path: 'u/me/app' })).toBe('/apps_raw/edit/u/me/app')
 	})
 
-	it('returns undefined for no target or a kind without a full-page route', () => {
+	it('maps a pipeline to its folder page, whichever form the folder is given in', () => {
+		expect(sessionTargetHref({ kind: 'pipeline', path: 'crm' })).toBe('/pipeline/crm')
+		expect(sessionTargetHref({ kind: 'pipeline', path: 'f/crm' })).toBe('/pipeline/crm')
+	})
+
+	it('returns undefined for no target', () => {
 		expect(sessionTargetHref(undefined)).toBeUndefined()
-		expect(sessionTargetHref({ kind: 'pipeline', path: 'u/me/pipe' })).toBeUndefined()
 	})
 })
 
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
index 1104e1c4b3..25529262b0 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
@@ -455,20 +455,15 @@ export class SessionPreviewTabs {
 			}
 		}
 		const url = targetUrl(target)
-		// Pipeline previews all share one runtime.pipelineEditorState, so keep at
-		// most one pipeline tab: re-point the existing one to the requested folder
-		// rather than opening a second pipeline editor that would fight over the
-		// shared state (`focused` when it already showed this folder, else `opened`
-		// since the view now shows a different pipeline).
+		// One tab per pipeline folder: two would mount two editors over one folder's
+		// state and draft.
 		const pipelineFolder = parsePipelineRoute(url)
 		if (pipelineFolder) {
-			const existing = this.#tabs.find((t) => parsePipelineRoute(t.url) !== null)
+			const existing = this.#tabs.find((t) => parsePipelineRoute(t.url) === pipelineFolder)
 			if (existing) {
-				const same = existing.url === url
-				this.#retarget(existing, url)
 				this.#activeId = existing.id
 				this.#flush()
-				return { status: same ? 'focused' : 'opened' }
+				return { status: 'focused' }
 			}
 		}
 		// Dedupe artifacts by id, not full url: an update may have changed the name the url carries.
@@ -543,15 +538,11 @@ export class SessionPreviewTabs {
 				return
 			}
 		}
-		// Keep at most one pipeline tab (all share runtime.pipelineEditorState): if a
-		// *different* tab already hosts a pipeline, retarget and focus it rather than
-		// turning the active tab into a second pipeline editor racing the shared
-		// state. Same invariant as open(); a no-op when the active tab is that tab.
+		// Same one-tab-per-folder rule as open(): focus the tab already on this folder.
 		const pipelineFolder = parsePipelineRoute(targetUrl(target))
 		if (pipelineFolder) {
-			const existing = this.#tabs.find((x) => parsePipelineRoute(x.url) !== null)
+			const existing = this.#tabs.find((x) => parsePipelineRoute(x.url) === pipelineFolder)
 			if (existing && existing.id !== t.id) {
-				this.#retarget(existing, targetUrl(target, existing))
 				this.#activeId = existing.id
 				this.#flush()
 				return
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
index 994624511a..e2318bcca9 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
@@ -578,19 +578,22 @@ describe('SessionPreviewTabs.navigate', () => {
 		expect(o.tabs.find((t) => t.id === pageTabId)?.url).toBe('/runs')
 	})
 
-	it('retargets the one pipeline tab instead of turning the active tab into a second', () => {
+	it('keeps one tab per pipeline folder, several folders side by side', () => {
 		const o = owner()
 		o.open(pipelineTarget)
-		const pipelineTabId = o.activeId
-		o.open(scriptTarget) // a second, non-pipeline tab is now active
-		const scriptTabId = o.activeId
-		o.navigate(pipelineTarget2)
-		// No second pipeline editor: the existing one is retargeted and focused.
+		const crmTabId = o.activeId
+		o.open(pipelineTarget2)
+		const salesTabId = o.activeId
 		expect(o.tabs).toHaveLength(2)
-		expect(o.activeId).toBe(pipelineTabId)
-		expect(o.tabs.find((t) => t.id === pipelineTabId)?.url).toBe(`${base}/pipeline/sales`)
-		// The script tab is untouched.
-		expect(o.tabs.find((t) => t.id === scriptTabId)?.url).toBe('/scripts/edit/u/me/foo')
+		expect(salesTabId).not.toBe(crmTabId)
+		o.open(scriptTarget)
+		// A folder already open is focused, from open() and navigate() alike.
+		o.open(pipelineTarget)
+		expect(o.activeId).toBe(crmTabId)
+		o.navigate(pipelineTarget2)
+		expect(o.activeId).toBe(salesTabId)
+		expect(o.tabs).toHaveLength(3)
+		expect(o.tabs.find((t) => t.id === crmTabId)?.url).toBe(`${base}/pipeline/crm`)
 	})
 
 	it('retargets the active pipeline tab in place to a new folder', () => {
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index 10cc938fbe..f7ff8c6863 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -5,6 +5,8 @@ import { invalidate as invalidateWorkspaceItems } from '$lib/components/workspac
 import { invalidateWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
 import { AIChatManager, AIMode } from '$lib/components/copilot/chat/AIChatManager.svelte'
 import { PipelineEditorState } from '$lib/components/assets/AssetGraph/pipelineEditorState.svelte'
+import { PIPELINE_DRAFT_KIND, pipelineBundlePath, pipelineLocalMirrorKey } from '$lib/pipelinePaths'
+import type { DeployResult } from '$lib/utils_workspace_deploy'
 import { initFlow } from '$lib/components/flows/flowStore.svelte'
 import {
 	ApiError,
@@ -135,6 +137,12 @@ export interface LoadSlot {
 
 export type SessionTargetKind = 'flow' | 'script' | 'raw_app'
 
+/** What a mounted pipeline editor view offers the rest of the session. */
+export interface PipelineView {
+	/** Deploy all of the folder's drafts; failures stay drafts and are shown in the view. */
+	deployAll(): Promise<DeployResult>
+}
+
 // The live runtime value a raw-app editor cell binds. Legacy drag-and-drop apps
 // are intentionally NOT hosted in the session preview (only code-based raw apps).
 export interface RawAppRuntimeValue {
@@ -207,9 +215,17 @@ export interface SessionRuntime {
 	// (renderer) and the open_preview/get_preview_status tools cross it, so the
 	// tab model has exactly one live copy.
 	readonly previewTabs: SessionPreviewTabs
-	// Pipeline target state — persists across editor hide/show (the pane unmounts
-	// on hide, so this can't be component-local) and across session switches.
-	readonly pipelineEditorState: PipelineEditorState
+	// Pipeline editor state per folder — persists across editor remounts and
+	// session switches, so it can't be component-local. Created on first use.
+	pipelineEditor(folder: string): PipelineEditorState
+	// A mounted pipeline editor view offers its deploy here; returns the unregister.
+	registerPipelineView(folder: string, view: PipelineView): () => void
+	// Deploy a folder's pipeline drafts through its editor tab, opening the tab if
+	// needed: the tab hydrates the drafts and shows what deployed and what failed.
+	deployPipeline(folder: string): Promise<DeployResult>
+	// Drop a folder's in-memory drafts once its draft bundle is discarded, so an
+	// open or later-mounted editor does not save them back.
+	forgetPipelineDrafts(folder: string): Promise<void>
 	// Per-(kind, path) editor cells (content/baseline stores + load slot), created
 	// on demand. Each editable preview tab resolves its own cell, so several items
 	// stay live at once.
@@ -618,10 +634,78 @@ function createRuntime(session: Session): SessionRuntime {
 	// picker lists, so changeMode's network refreshes would fire once per listing.
 	manager.configureGlobalMode()
 
-	// Pipeline target state lives on the runtime (not the PipelineEditorView
-	// component) so the in-session drafts survive hide/show of the editor pane —
-	// the pane unmounts on hide, and a component-local store would be discarded.
-	const pipelineEditorState = new PipelineEditorState()
+	const pipelineEditors = new Map<string, PipelineEditorState>()
+	function pipelineEditor(folder: string): PipelineEditorState {
+		const key = normalizePipelineFolder(folder)
+		let editor = pipelineEditors.get(key)
+		if (!editor) {
+			editor = new PipelineEditorState()
+			editor.folder = key
+			pipelineEditors.set(key, editor)
+		}
+		return editor
+	}
+
+	const pipelineViews = new Map<string, PipelineView>()
+	const pipelineViewWaiters = new Map<string, Set<(view: PipelineView) => void>>()
+	function registerPipelineView(folder: string, view: PipelineView): () => void {
+		const key = normalizePipelineFolder(folder)
+		pipelineViews.set(key, view)
+		const waiters = pipelineViewWaiters.get(key)
+		pipelineViewWaiters.delete(key)
+		waiters?.forEach((notify) => notify(view))
+		return () => {
+			if (pipelineViews.get(key) === view) pipelineViews.delete(key)
+		}
+	}
+	function pipelineViewFor(folder: string, timeoutMs = 15000): Promise<PipelineView | undefined> {
+		const mounted = pipelineViews.get(folder)
+		if (mounted) return Promise.resolve(mounted)
+		return new Promise((resolve) => {
+			const waiters = pipelineViewWaiters.get(folder) ?? new Set()
+			pipelineViewWaiters.set(folder, waiters)
+			const notify = (view: PipelineView) => {
+				clearTimeout(timer)
+				resolve(view)
+			}
+			const timer = setTimeout(() => {
+				waiters.delete(notify)
+				resolve(undefined)
+			}, timeoutMs)
+			waiters.add(notify)
+		})
+	}
+	manager.setPipelineReopener((folder) => {
+		const target = previewTargetForSessionTarget('pipeline', folder)
+		if (target) previewTabs.open(target)
+	})
+	async function deployPipeline(folder: string): Promise<DeployResult> {
+		const key = normalizePipelineFolder(folder)
+		const target = previewTargetForSessionTarget('pipeline', key)
+		if (target) previewTabs.open(target)
+		const view = await pipelineViewFor(key)
+		if (!view) return { success: false, error: `The pipeline editor for f/${key} did not open.` }
+		return view.deployAll()
+	}
+	async function forgetPipelineDrafts(folder: string): Promise<void> {
+		const key = normalizePipelineFolder(folder)
+		const editor = pipelineEditors.get(key)
+		if (editor) {
+			// The open pane saves its edits back as a draft when it closes: let it, then
+			// drop that draft with the rest, or it would come back afterwards.
+			await editor.closePane()
+			editor.drafts = new Map()
+			editor.triggerDrafts = new Map()
+			editor.clearLiveOverlays()
+		}
+		// The editor's crash mirror, which its load falls back to when the DB has
+		// no draft: left behind, it would restore what was just discarded.
+		try {
+			localStorage.removeItem(pipelineLocalMirrorKey(key))
+		} catch {
+			// Storage unavailable: nothing was mirrored either.
+		}
+	}
 
 	const runtimeLogRequesters = new Map<string, RawAppRuntimeLogRequester>()
 	// appPath → requester, one entry per mounted raw-app preview tab.
@@ -635,7 +719,10 @@ function createRuntime(session: Session): SessionRuntime {
 		sessionId: session.id,
 		manager,
 		previewTabs,
-		pipelineEditorState,
+		pipelineEditor,
+		registerPipelineView,
+		deployPipeline,
+		forgetPipelineDrafts,
 		flowCell,
 		loadedEditorPath,
 		deployedRevision,
@@ -1167,6 +1254,18 @@ export function listRuntimes(): SessionRuntime[] {
 	return Array.from(runtimes.values())
 }
 
+/** A pipeline deleted outside the session: every live session on its workspace
+ * drops what it holds of it. Its in-memory drafts would otherwise keep showing the
+ * pipeline in the preview, and autosave would write the deleted draft back. */
+export function forgetDeletedPipeline(workspace: string, folder: string): void {
+	const key = normalizePipelineFolder(folder)
+	for (const runtime of runtimes.values()) {
+		if (runtime.manager.operatingWorkspace !== workspace) continue
+		void runtime.forgetPipelineDrafts(key)
+		void runtime.manager.removeModifiedItem(PIPELINE_DRAFT_KIND, pipelineBundlePath(key))
+	}
+}
+
 export function getRuntime(sessionId: string): SessionRuntime | undefined {
 	return runtimes.get(sessionId)
 }
@@ -1305,8 +1404,8 @@ setOpenPreviewHandler(async ({ sessionId: callerSessionId, kind, path, mode }) =
 	// "Unknown tool call" error on the first node it tries to build.
 	if (kind === 'pipeline') {
 		const folder = normalizePipelineFolder(path)
-		const ready = await runtime.manager.waitForPipelineHelpers()
-		// A backgrounded session's preview tab does not mount, so its editor never
+		const ready = await runtime.manager.waitForPipelineHelpers(folder)
+		// A session whose page is not mounted never mounts the editor, so it never
 		// registers — don't claim success, or the model calls build_pipeline_node
 		// into the void. Tell it the tools aren't available and how to recover.
 		if (!ready) {
@@ -1316,7 +1415,7 @@ setOpenPreviewHandler(async ({ sessionId: callerSessionId, kind, path, mode }) =
 		// off the owner path twice over) is rejected by build_pipeline_node.
 		return `${
 			result.status === 'focused' ? 'Focused the' : 'Opened the'
-		} pipeline editor for folder "${folder}" in the side panel. Its nodes go at paths under \`f/${folder}/\` (e.g. \`f/${folder}/<node_name>\`).`
+		} pipeline editor for folder "${folder}" in the side panel. build_pipeline_node, edit_pipeline_node and the other pipeline tools are now in your tool list: call them in your next step. Its nodes go at paths under \`f/${folder}/\` (e.g. \`f/${folder}/<node_name>\`).`
 	}
 	return result.status === 'focused'
 		? `A preview tab is already showing ${kind} "${path}" — focused it.`
@@ -1459,6 +1558,14 @@ setGetRuntimeLogsHandler(async ({ sessionId: callerSessionId, limit, appPath })
 			toolResult: report
 		}
 	}
+	if (previewLogs?.sdkConsentPending) {
+		return {
+			aiResult:
+				'The app built, but the preview is waiting for the user to approve the permissions the app declares in policy.frontend_sdk_scopes, so its code is not running. This is not a bug in the app: do not change the code. Ask the user to approve the permissions in the preview, then call get_app_runtime_logs again.',
+			uiMessage: 'Waiting for permission approval',
+			toolResult: 'Waiting for permission approval'
+		}
+	}
 	const entries = previewLogs?.entries
 	if (entries === undefined) {
 		return {
diff --git a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
index a0ef0e5696..30b7792487 100644
--- a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
@@ -15,7 +15,7 @@ import {
 	type SessionTarget
 } from './sessionState.svelte'
 import { sessionTargetHref, withPreviewParams } from './sessionMode.svelte'
-import { parsePreviewItemRoute, type PreviewItemRoute } from './previewPaths'
+import { parsePipelineRoute, parsePreviewItemRoute } from './previewPaths'
 import { findMountedOpenInSessionSource } from './openInSessionContext'
 // Type-only: erased at compile time, so the component graph stays out of this
 // navigation seam (see the dynamic import in openEditorInSession).
@@ -42,10 +42,28 @@ export function rememberNavRoute(pathnameWithSearch: string): void {
 }
 
 /** An item editor the user reached session mode from, as the in-app href a new
- * session's preview can open, plus the item it edits (for naming it). */
-export type NewSessionSeed = { url: string; route: PreviewItemRoute }
+ * session's preview can open, plus what it edits (for naming it). */
+export type NewSessionSeed = { url: string; kind: string; path: string }
 
-// The item (flow, script, app) the user came to session mode from, or undefined
+/** What an editor route edits: a session target, or an unset target for an item
+ * with no in-session editor (a legacy app), which is opened by its page instead. */
+function editedAt(
+	url: string
+): { target: SessionTarget | undefined; kind: string; path: string } | undefined {
+	const folder = parsePipelineRoute(url)
+	if (folder)
+		return { target: { kind: 'pipeline', path: folder }, kind: 'pipeline', path: `f/${folder}` }
+	const route = parsePreviewItemRoute(url)
+	if (!route) return undefined
+	const kind = route.kind === 'app' ? (route.raw_app ? 'raw_app' : undefined) : route.kind
+	return {
+		target: kind ? { kind, path: route.itemPath } : undefined,
+		kind: route.kind,
+		path: route.itemPath
+	}
+}
+
+// The item (flow, script, app, pipeline) the user came to session mode from, or undefined
 // when they came from anywhere else. A "New session" asked for after arriving
 // from an item is usually a session about that item, but the arrival route
 // (`enterSessionMode`) resumes whatever session was open, so the picker offers
@@ -56,8 +74,8 @@ export type NewSessionSeed = { url: string; route: PreviewItemRoute }
 export function takeNewSessionSeed(): NewSessionSeed | undefined {
 	if (navRouteOffered) return undefined
 	navRouteOffered = true
-	const route = parsePreviewItemRoute(lastNavRoute)
-	return route ? { url: lastNavRoute, route } : undefined
+	const edited = editedAt(lastNavRoute)
+	return edited ? { url: lastNavRoute, kind: edited.kind, path: edited.path } : undefined
 }
 
 // The session entering session mode resumes: the active one if selected, else
@@ -102,8 +120,8 @@ const RESUME_IDLE_LIMIT_MS = 60 * 60 * 1000
 // enterSessionMode does. Rejects when the editor could not persist its draft,
 // so the caller can stay on the page and say so.
 export async function enterSessionModeFromNav(): Promise<void> {
-	const route = parsePreviewItemRoute(lastNavRoute)
-	if (route) {
+	const edited = editedAt(lastNavRoute)
+	if (edited) {
 		const resumable = resumableSession()
 		if (!resumable || Date.now() - sessionLastActivityAt(resumable) > RESUME_IDLE_LIMIT_MS) {
 			// The editor's own hand-off is what its "Open in AI session" button uses:
@@ -112,7 +130,7 @@ export async function enterSessionModeFromNav(): Promise<void> {
 			// workspace the item lives in. Only an item with no such editor on
 			// screen (a legacy app, a detail page) is opened by route, as last
 			// persisted, in the workspace the route was scoped to.
-			const source = findMountedOpenInSessionSource(route)
+			const source = edited.target && findMountedOpenInSessionSource(edited.target)
 			if (source) await openSourceInSession(source)
 			else await openPageInSession(lastNavRoute, workspaceParamOf(lastNavRoute))
 			return
diff --git a/frontend/src/lib/components/sessions/sessionSwitch.test.ts b/frontend/src/lib/components/sessions/sessionSwitch.test.ts
index 4eae32da6b..497e3cbad9 100644
--- a/frontend/src/lib/components/sessions/sessionSwitch.test.ts
+++ b/frontend/src/lib/components/sessions/sessionSwitch.test.ts
@@ -259,16 +259,21 @@ describe('takeNewSessionSeed', () => {
 		rememberNavRoute('/flows/edit/u/me/my_flow?workspace=ws')
 		expect(takeNewSessionSeed()).toEqual({
 			url: '/flows/edit/u/me/my_flow?workspace=ws',
-			route: { kind: 'flow', raw_app: false, itemPath: 'u/me/my_flow', mode: 'edit' }
+			kind: 'flow',
+			path: 'u/me/my_flow'
 		})
 		// A dismissed or taken offer is not repeated until the user leaves again.
 		expect(takeNewSessionSeed()).toBeUndefined()
 		rememberNavRoute('/apps_raw/edit/f/team/dashboard?workspace=ws')
-		expect(takeNewSessionSeed()?.route).toEqual({
-			kind: 'app',
-			raw_app: true,
-			itemPath: 'f/team/dashboard',
-			mode: 'edit'
+		expect(takeNewSessionSeed()).toMatchObject({ kind: 'app', path: 'f/team/dashboard' })
+	})
+
+	it('offers the pipeline the user came from, named by its folder', () => {
+		rememberNavRoute('/pipeline/crm?workspace=ws')
+		expect(takeNewSessionSeed()).toEqual({
+			url: '/pipeline/crm?workspace=ws',
+			kind: 'pipeline',
+			path: 'f/crm'
 		})
 	})
 
diff --git a/frontend/src/lib/components/settings/CreateToken.svelte b/frontend/src/lib/components/settings/CreateToken.svelte
index 8ee5391443..56952eb584 100644
--- a/frontend/src/lib/components/settings/CreateToken.svelte
+++ b/frontend/src/lib/components/settings/CreateToken.svelte
@@ -245,6 +245,8 @@
 	// Undefined wherever the workspace is: `/api/mcp/w/undefined/mcp` reads like a real URL
 	// and is copyable, so the OAuth panel withholds it rather than showing a broken one. The
 	// token branch guards the same case by disabling its generate button.
+	// On the browsing origin, not the API base url: the OAuth metadata the server
+	// publishes for this URL is built from `base_url`, and a client rejects a mismatch.
 	const mcpUrl = $derived(
 		isAllWorkspaces
 			? `${window.location.origin}/api/mcp/gateway`
diff --git a/frontend/src/lib/components/settings/PremiumInfo.svelte b/frontend/src/lib/components/settings/PremiumInfo.svelte
index b96ab5e22b..766b2c6495 100644
--- a/frontend/src/lib/components/settings/PremiumInfo.svelte
+++ b/frontend/src/lib/components/settings/PremiumInfo.svelte
@@ -261,8 +261,7 @@
 									<div class="flex flex-col gap-0.5">
 										<div class="font-medium">Developers</div>
 										<p class="text-xs text-secondary">
-											Calculated on the MAXIMUM number of users in a given billing period, see the
-											Customer Portal for more info.
+											1 seat each.
 										</p>
 									</div>
 								</Cell>
@@ -277,8 +276,7 @@
 									<div class="flex flex-col gap-0.5">
 										<div class="font-medium">Operators</div>
 										<p class="text-xs text-secondary">
-											Calculated on the MAXIMUM number of operators in a given billing period, see
-											the Customer Portal for more info.
+											Half a seat each.
 										</p>
 									</div>
 								</Cell>
@@ -293,7 +291,7 @@
 									<div class="flex flex-col gap-0.5">
 										<div class="font-medium">Service accounts</div>
 										<p class="text-xs text-secondary">
-											Enabled service accounts, half a seat each like operators, whatever their role.
+											Half a seat each, whatever their role.
 										</p>
 									</div>
 								</Cell>
@@ -383,8 +381,9 @@
 											Used seats (billed)
 										</div>
 										<p class="text-xs text-secondary">
-											Highest between seats from 'Developers + Operators' and 'Seats from
-											executions'. This is the number of seats used for billing this month.
+											'Seats from users' plus 'Extra seats from computations'. Billed on the
+											highest total reached during the month; your invoices in the Customer Portal
+											show what was billed.
 										</p>
 										<p class="text-[11px] text-secondary font-mono">
 											u + c = {formatNumber(premiumInfo.usedSeats)}
@@ -417,7 +416,7 @@
 			<div class="text-sm font-semibold text-primary">Estimate your monthly cost</div>
 			<p class="text-xs text-secondary max-w-xl">
 				This is a rough estimate based on your expected team size and workload. Actual billing is
-				based on the maximum number of users and executions in a given month.
+				based on the highest seat total reached during the month.
 			</p>
 		</div>
 
diff --git a/frontend/src/lib/components/sidebar/MenuButton.svelte b/frontend/src/lib/components/sidebar/MenuButton.svelte
index 3d0286a4af..e6f23361bf 100644
--- a/frontend/src/lib/components/sidebar/MenuButton.svelte
+++ b/frontend/src/lib/components/sidebar/MenuButton.svelte
@@ -54,6 +54,8 @@
 		// Classes for the label line only — `class` reaches the button, the label and the
 		// sublabel alike, which is the wrong tool for colouring one line of the two.
 		labelClass?: string | undefined
+		// Draw the colour disc at 20px rather than 26px, for denser rows such as the page header.
+		compact?: boolean
 	}
 
 	let {
@@ -79,7 +81,8 @@
 		emphasizeLabel = false,
 		disableTitle = false,
 		ariaLabel = undefined,
-		labelClass = undefined
+		labelClass = undefined,
+		compact = false
 	}: Props = $props()
 
 	let buttonRef: HTMLButtonElement | HTMLAnchorElement | undefined = $state(undefined)
@@ -94,7 +97,7 @@
 	<Popover
 		appearTimeout={0}
 		disappearTimeout={0}
-		class="w-full"
+		class={compact ? 'w-auto' : 'w-full'}
 		disablePopup={!isCollapsed}
 		placement="right"
 	>
@@ -119,7 +122,8 @@
 			{href}
 			data-light-mode={lightMode}
 			class={twMerge(
-				'group flex items-center px-2 py-2 font-light rounded-md gap-2 w-full',
+				'group flex items-center px-2 py-2 font-light rounded-md gap-2',
+				compact ? 'w-auto' : 'w-full',
 				sidebarClasses.hoverBg,
 				'transition-all relative',
 				sublabel ? 'h-10' : 'h-8',
@@ -134,11 +138,23 @@
 			{#if icon}
 				{@const SvelteComponent = icon}
 				{#if color}
-					<svg width="26" height="26" viewBox="0 0 26 26" class="flex-shrink-0 -ml-[5px]">
-						<circle cx="13" cy="13" r="13" fill={color} />
-						<foreignObject x="5" y="5" width="16" height="16">
+					{@const disc = compact ? 20 : 26}
+					{@const glyph = compact ? 12 : 16}
+					<svg
+						width={disc}
+						height={disc}
+						viewBox="0 0 {disc} {disc}"
+						class="flex-shrink-0 {compact ? '-ml-[3px]' : '-ml-[5px]'}"
+					>
+						<circle cx={disc / 2} cy={disc / 2} r={disc / 2} fill={color} />
+						<foreignObject
+							x={(disc - glyph) / 2}
+							y={(disc - glyph) / 2}
+							width={glyph}
+							height={glyph}
+						>
 							<SvelteComponent
-								size={16}
+								size={glyph}
 								class={twMerge(sidebarClasses.iconText, 'transition-colors', iconClasses)}
 								{...iconProps}
 							/>
@@ -158,7 +174,7 @@
 				{/if}
 			{/if}
 
-			<div class="flex flex-col text-left grow min-w-0">
+			<div class="flex flex-col text-left min-w-0 {compact ? '' : 'grow'}">
 				{#if !isCollapsed && label}
 					<div
 						class={twMerge(
diff --git a/frontend/src/lib/components/sidebar/OperatorMenu.svelte b/frontend/src/lib/components/sidebar/OperatorMenu.svelte
deleted file mode 100644
index 2d35ce7e10..0000000000
--- a/frontend/src/lib/components/sidebar/OperatorMenu.svelte
+++ /dev/null
@@ -1,337 +0,0 @@
-<script lang="ts">
-	import {
-		Home,
-		Menu as MenuIcon,
-		Play,
-		Settings,
-		LogOut,
-		Moon,
-		Sun,
-		Code2,
-		LayoutDashboard,
-		Calendar,
-		ServerCog,
-		Table2,
-		GraduationCap
-	} from 'lucide-svelte'
-	import SwitchWorkspaceSubmenu from './SwitchWorkspaceSubmenu.svelte'
-	import {
-		OPERATOR_MAIN_LINKS,
-		OPERATOR_SECONDARY_LINKS,
-		OPERATOR_TRIGGER_LINKS,
-		type OperatorMenuLink,
-		type OperatorTriggerLink
-	} from './operatorRoutes'
-	import { base } from '$lib/base'
-	import { page } from '$app/state'
-	import { TOUR_PARAM, TOUR_PARAM_VALUE } from '$lib/components/tutorials/operatorTour'
-
-	import MultiplayerMenu from './MultiplayerMenu.svelte'
-	import { Plus } from 'lucide-svelte'
-	import {
-		enterpriseLicense,
-		superadmin,
-		usedTriggerKinds,
-		userWorkspaces,
-		workspaceColor,
-		workspaceStore
-	} from '$lib/stores'
-	import { twMerge } from 'tailwind-merge'
-	import { getContrastTextColor } from '$lib/utils'
-	import { USER_SETTINGS_HASH } from './settings'
-	import { logout } from '$lib/logoutKit'
-	import DarkModeObserver from '../DarkModeObserver.svelte'
-	import BarsStaggered from '../icons/BarsStaggered.svelte'
-	import { Menu, Menubar, MenuItem } from '$lib/components/meltComponents'
-	import MenuButton, { sidebarClasses } from './MenuButton.svelte'
-	import MenuLink from './MenuLink.svelte'
-	import type { FavoriteKind } from './FavoriteMenu.svelte'
-	let darkMode: boolean = $state(false)
-	let showExtraTriggers = $state(false)
-	// The menu opens on hover, so this doubles as "the pointer is on the button":
-	// it slides the workspace name out beside the icon, and keeps it out once a
-	// click has pinned the menu open and the pointer has moved away.
-	let menuOpen = $state(false)
-
-	interface Props {
-		isCollapsed?: boolean
-		favoriteLinks?: {
-			label: string
-			href: string
-			kind: FavoriteKind
-		}[]
-	}
-
-	let { isCollapsed = false, favoriteLinks = [] }: Props = $props()
-
-	const MAIN_LINK_ICONS: Record<string, any> = { home: Home, runs: Play, schedules: Calendar }
-	let activeWorkspace = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
-	let workspaceName = $derived(activeWorkspace?.name ?? $workspaceStore ?? '')
-	// Home is where an operator lands and gets their bearings, so the name stays out there
-	// rather than waiting for a hover. Everywhere else the button is the page's own chrome
-	// and stays out of the way until asked.
-	let showWorkspaceName = $derived(menuOpen || page.url.pathname === `${base}/`)
-	// Most workspaces never get a colour (it is only ever set explicitly), and this button
-	// floats over page content with nothing else behind it — so the disc falls back to a
-	// neutral rather than vanishing, keeping the glyph on a ground of its own everywhere.
-	// A token rather than a hex so it follows the theme; getContrastTextColor only parses
-	// hex, so it returns undefined here and the glyph keeps its themed `text-hint`.
-	const NEUTRAL_DISC = 'rgb(var(--color-surface-sunken))'
-
-	let mainMenuLinks = $derived(
-		OPERATOR_MAIN_LINKS.map((link) => ({ ...link, icon: MAIN_LINK_ICONS[link.id] })).filter(
-			(link) => link.id === 'home' || filterLink(link)
-		)
-	)
-
-	function filterLink(link: OperatorMenuLink) {
-		if (!$userWorkspaces || !$workspaceStore) return false
-		return activeWorkspace?.operator_settings?.[link.id] === true
-	}
-	let secondMenuLinks: OperatorMenuLink[] = $derived(OPERATOR_SECONDARY_LINKS.filter(filterLink))
-	let allTriggerLinks: OperatorTriggerLink[] = $derived(OPERATOR_TRIGGER_LINKS.filter(filterLink))
-	let secondMenuTriggerLinks = $derived(
-		allTriggerLinks.filter((link) => $usedTriggerKinds.includes(link.kind))
-	)
-	let extraTriggerLinks = $derived(
-		allTriggerLinks.filter((link) => !$usedTriggerKinds.includes(link.kind))
-	)
-</script>
-
-<Menubar>
-	{#snippet children({ createMenu })}
-		<Menu
-			{createMenu}
-			placement="bottom-start"
-			openOnHover
-			usePointerDownOutside
-			submenuSafe
-			bind:open={menuOpen}
-			on:close={() => (showExtraTriggers = false)}
-		>
-			{#snippet triggr({ trigger, pinned })}
-				{@const iconColor = getContrastTextColor($workspaceColor)}
-				<!-- Ground for the expanded state only: the button floats over page content and its
-				     hover tint is translucent, so the name would otherwise sit on whatever is
-				     underneath. Icon-only needs none — the disc is always drawn. -->
-				<div class="flex rounded-md {showWorkspaceName ? 'bg-surface' : ''}">
-					<MenuButton
-						class="!text-xs"
-						buttonClass={twMerge(
-							'!pl-3.5 !pr-2 !w-auto',
-							// A hover-opened menu leaves the button plain once the pointer moves on;
-							// keeping the tint is what tells you the click pinned it.
-							pinned ? sidebarClasses.selectedBg : ''
-						)}
-						icon={MenuIcon}
-						isCollapsed={false}
-						lightMode
-						color={$workspaceColor ?? NEUTRAL_DISC}
-						iconProps={iconColor ? { style: `color: ${iconColor}` } : undefined}
-						label={showWorkspaceName ? workspaceName : undefined}
-						ariaLabel={workspaceName ? `Menu — ${workspaceName}` : 'Menu'}
-						{trigger}
-					/>
-				</div>
-			{/snippet}
-			{#snippet children({ item, builders })}
-				<div class="w-full max-w-full">
-					{#each favoriteLinks ?? [] as favorite (favorite.href)}
-						<MenuItem
-							href={favorite.href}
-							{item}
-							class={twMerge(
-								'w-full inline-flex flex-row px-2 py-2',
-								'data-[highlighted]:bg-surface-hover'
-							)}
-						>
-							<span class="center-center">
-								{#if favorite.kind == 'script'}
-									<Code2 size={16} />
-								{:else if favorite.kind == 'flow'}
-									<BarsStaggered size={16} />
-								{:else if favorite.kind == 'app' || favorite.kind == 'raw_app'}
-									<LayoutDashboard size={16} />
-								{:else if favorite.kind == 'asset'}
-									<Table2 size={16} />
-								{/if}
-							</span>
-							<span class="text-primary ml-2 grow min-w-0 text-xs truncate">
-								{favorite.label}
-							</span>
-						</MenuItem>
-					{/each}
-				</div>
-
-				{#each mainMenuLinks as menuLink (menuLink.href ?? menuLink.label)}
-					<MenuLink class="!text-xs" {...menuLink} {isCollapsed} {item} lightMode />
-				{/each}
-
-				<div class="divide-y" role="none">
-					<div role="none">
-						<MenuItem
-							href={USER_SETTINGS_HASH}
-							class={twMerge(
-								'flex flex-row gap-3.5 items-center px-2 py-2',
-								sidebarClasses.text,
-								'transition-colors',
-								'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-							)}
-							lightMode
-							{item}
-						>
-							<Settings size={14} />
-							Account settings
-						</MenuItem>
-
-						<MenuItem
-							href="{base}/?{TOUR_PARAM}={TOUR_PARAM_VALUE}"
-							class={twMerge(
-								'flex flex-row gap-3.5 items-center px-2 py-2',
-								sidebarClasses.text,
-								'transition-colors',
-								'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-							)}
-							lightMode
-							{item}
-						>
-							<GraduationCap size={14} />
-							Take the tour
-						</MenuItem>
-					</div>
-
-					<div role="none">
-						<MenuItem
-							onClick={() => {
-								if (!document.documentElement.classList.contains('dark')) {
-									document.documentElement.classList.add('dark')
-									window.localStorage.setItem('dark-mode', 'dark')
-								} else {
-									document.documentElement.classList.remove('dark')
-									window.localStorage.setItem('dark-mode', 'light')
-								}
-							}}
-							lightMode
-							class={twMerge(
-								'w-full flex gap-3.5 px-2 py-2',
-								'transition-colors',
-								sidebarClasses.text,
-								'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-							)}
-							{item}
-						>
-							{#if darkMode}
-								<Sun size={14} />
-							{:else}
-								<Moon size={14} />
-							{/if}
-							Switch theme
-						</MenuItem>
-						<SwitchWorkspaceSubmenu {builders} {item} />
-
-						{#if $superadmin}
-							<MenuItem
-								href="#superadmin-settings"
-								class={twMerge(
-									'flex flex-row gap-3.5 items-center px-2 py-2 ',
-									'text-secondary text-xs',
-									'cursor-pointer',
-									'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-								)}
-								{item}
-							>
-								<ServerCog size={14} />
-								Instance settings
-							</MenuItem>
-						{/if}
-
-						<MenuItem
-							onClick={() => logout()}
-							class={twMerge(
-								'flex flex-row gap-3.5  items-center px-2 py-2 w-full',
-								'text-primary text-xs',
-								'cursor-pointer',
-								'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-							)}
-							{item}
-						>
-							<LogOut size={14} />
-							Sign out
-						</MenuItem>
-					</div>
-					<div role="none">
-						{#snippet renderSecondMenuLinks(menuLinks: OperatorMenuLink[])}
-							{#each menuLinks as menuLink (menuLink.href ?? menuLink.label)}
-								<MenuItem
-									href={menuLink.href}
-									class={twMerge(
-										'flex flex-row gap-3.5 items-center px-2 py-2 text-secondary text-2xs cursor-pointer',
-										'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-									)}
-									{item}
-								>
-									{menuLink.label}
-								</MenuItem>
-							{/each}
-						{/snippet}
-						{#if secondMenuLinks.length || secondMenuTriggerLinks.length || extraTriggerLinks.length}
-							<div class="divide-y">
-								{#if secondMenuLinks.length}<div
-										>{@render renderSecondMenuLinks(secondMenuLinks)}</div
-									>{/if}
-								{#if secondMenuTriggerLinks.length}<div
-										>{@render renderSecondMenuLinks(secondMenuTriggerLinks)}</div
-									>{/if}
-								{#if extraTriggerLinks.length}<div>
-										<!-- svelte-ignore a11y_no_static_element_interactions -->
-										<div
-											role="none"
-											onclickcapture={(e) => {
-												// This row expands the list below it instead of acting on the selection, and
-												// melt keeps the menu open only for a click it sees as defaultPrevented.
-												// Svelte delegates onclick to the root, which runs after melt's own listener,
-												// and a capture listener on the item itself would be ordered only by
-												// registration, so an ancestor's capture phase is what reliably wins.
-												e.preventDefault()
-												showExtraTriggers = !showExtraTriggers
-											}}
-										>
-											<MenuItem
-												class={twMerge(
-													'flex flex-row gap-3.5 items-center px-2 py-2 w-full text-secondary text-2xs cursor-pointer',
-													'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-												)}
-												{item}
-											>
-												<Plus size={12} />
-												<span class="text-2xs">More triggers</span>
-											</MenuItem>
-										</div>
-										{#if showExtraTriggers}
-											{#each extraTriggerLinks as menuLink (menuLink.href)}
-												<MenuItem
-													href={menuLink.href}
-													class={twMerge(
-														'flex flex-row gap-3.5 items-center px-2 py-2 pl-6 text-tertiary text-2xs cursor-pointer',
-														'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-													)}
-													{item}
-												>
-													{menuLink.label}
-												</MenuItem>
-											{/each}
-										{/if}
-									</div>{/if}
-							</div>
-						{/if}
-						{#if $enterpriseLicense}
-							<MultiplayerMenu />
-						{/if}
-					</div>
-				</div>
-			{/snippet}
-		</Menu>
-	{/snippet}
-</Menubar>
-
-<DarkModeObserver bind:darkMode />
diff --git a/frontend/src/lib/components/sidebar/SettingsMenu.svelte b/frontend/src/lib/components/sidebar/SettingsMenu.svelte
index e0951f37cd..fed773c84c 100644
--- a/frontend/src/lib/components/sidebar/SettingsMenu.svelte
+++ b/frontend/src/lib/components/sidebar/SettingsMenu.svelte
@@ -18,7 +18,8 @@
 		Crown,
 		Gauge,
 		Trash2,
-		KeyRound
+		KeyRound,
+		GraduationCap
 	} from 'lucide-svelte'
 	import { base } from '$app/paths'
 	import { goto } from '$lib/navigation'
@@ -38,6 +39,8 @@
 	import { USER_SETTINGS_HASH, SUPERADMIN_SETTINGS_HASH } from './settings'
 	import { accountSetup } from './accountSetup.svelte'
 	import { EXECUTIONS_HINT } from './executionsHint'
+	import { sidebarPageAllowed } from './operatorRoutes'
+	import { TOUR_PARAM, TOUR_PARAM_VALUE } from '$lib/components/tutorials/operatorTour'
 	import {
 		userWorkspaces,
 		workspaceStore,
@@ -248,6 +251,15 @@
 					icon: Settings,
 					action: () => goto(USER_SETTINGS_HASH)
 				},
+				...($userStore?.operator
+					? [
+							{
+								displayName: 'Take the tour',
+								icon: GraduationCap,
+								action: () => goto(`${base}/?${TOUR_PARAM}=${TOUR_PARAM_VALUE}`)
+							}
+						]
+					: []),
 				...(cloudHosted && $isPremiumStore === false
 					? [
 							{
@@ -307,6 +319,7 @@
 		label="Workers"
 		href="{base}/workers"
 		icon={ServerCog}
+		disabled={!sidebarPageAllowed($userStore?.operator, currentWs, 'workers')}
 		{isCollapsed}
 		aiId="sidebar-menu-link-workers"
 		aiDescription="Button to navigate to workers"
@@ -352,7 +365,7 @@
 			label="Audit logs"
 			href="{base}/audit_logs"
 			icon={Eye}
-			disabled={$userStore?.operator}
+			disabled={!sidebarPageAllowed($userStore?.operator, currentWs, 'audit_logs')}
 			{isCollapsed}
 			aiId="sidebar-menu-link-audit-logs"
 			aiDescription="Button to navigate to audit logs"
diff --git a/frontend/src/lib/components/sidebar/SidebarContent.svelte b/frontend/src/lib/components/sidebar/SidebarContent.svelte
index b43bc2988e..d8f27ff0c6 100644
--- a/frontend/src/lib/components/sidebar/SidebarContent.svelte
+++ b/frontend/src/lib/components/sidebar/SidebarContent.svelte
@@ -12,31 +12,25 @@
 	} from '$lib/stores'
 	import { isForkOwner } from '$lib/utils/workspaceHierarchy'
 	import { SIDEBAR_SHOW_SCHEDULES } from '$lib/consts'
+	import { NAV_PAGES } from './navPages'
 	import {
 		BookOpen,
 		ServerCog,
-		Boxes,
 		Calendar,
-		DollarSign,
 		Eye,
 		Logs,
 		FolderCog,
-		FolderOpen,
 		Github,
 		HelpCircle,
-		Home,
 		LogOut,
 		Newspaper,
-		Play,
 		Route,
 		Settings,
 		UserCog,
-		Users,
 		Plus,
 		Unplug,
 		AlertCircle,
 		Database,
-		Pyramid,
 		MailIcon,
 		ChevronDown,
 		ChevronRight
@@ -72,6 +66,7 @@
 	import GoogleCloudIcon from '../icons/triggers/GoogleCloudIcon.svelte'
 	import AzureIcon from '../icons/triggers/AzureIcon.svelte'
 	import { leaveCurrentWorkspace } from './leaveWorkspace'
+	import { sidebarPageAllowed, type OperatorPageKey } from './operatorRoutes'
 	import { markChangelogsOpened, readRecentChangelogs } from './changelogs'
 
 	const { recent: recentChangelogs, hasNew } = readRecentChangelogs()
@@ -188,78 +183,63 @@
 		return count
 	}
 
+	const currentWs = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
+	function allows(key: OperatorPageKey) {
+		return sidebarPageAllowed($userStore?.operator, currentWs, key)
+	}
+
 	const itemClass = twMerge(
 		'text-secondary font-normal w-full block px-4 py-2 text-2xs data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
 	)
-	let mainMenuLinks = $derived(
-		[
-			{
-				label: 'Home',
-				href: `${base}/`,
-				icon: Home,
-				aiId: 'sidebar-menu-link-home',
-				aiDescription:
-					"Button to navigate to home which contains all the user's scripts, flows and apps"
-			},
-			{
-				label: 'Runs',
-				href: `${base}/runs`,
-				icon: Play,
-				aiId: 'sidebar-menu-link-runs',
-				aiDescription: 'Button to navigate to runs',
-				onclick: () => {
-					setTimeout(() => {
-						window.dispatchEvent(new Event('popstate'))
-					}, 100)
-				}
-			},
-			{
-				label: 'Variables',
-				href: `${base}/variables`,
-				icon: DollarSign,
-				disabled: $userStore?.operator,
-				aiId: 'sidebar-menu-link-variables',
-				aiDescription: 'Button to navigate to variables'
-			},
-			{
-				label: 'Resources',
-				href: `${base}/resources`,
-				icon: Boxes,
-				disabled: $userStore?.operator,
-				aiId: 'sidebar-menu-link-resources',
-				aiDescription: 'Button to navigate to resources'
-			},
-			{
-				label: 'Assets',
-				href: `${base}/assets`,
-				icon: Pyramid,
-				aiId: 'sidebar-menu-link-assets',
-				aiDescription: 'Button to navigate to assets'
-			},
-			{
-				label: 'Folders',
-				href: `${base}/folders`,
-				icon: FolderOpen,
-				disabled: $userStore?.operator,
-				aiId: 'sidebar-menu-link-folders',
-				aiDescription: 'Button to navigate to folders'
-			},
-			{
-				label: 'Groups',
-				href: `${base}/groups`,
-				icon: Users,
-				disabled: $userStore?.operator,
-				aiId: 'sidebar-menu-link-groups',
-				aiDescription: 'Button to navigate to groups'
+	// Labels, paths and icons come from the shared page table, so the nav and the page header's
+	// breadcrumb always call a page the same thing. Everything else here is nav-only.
+	const MAIN_MENU_EXTRAS: Record<
+		string,
+		{ aiId: string; aiDescription: string; onclick?: () => void }
+	> = {
+		Home: {
+			aiId: 'sidebar-menu-link-home',
+			aiDescription:
+				"Button to navigate to home which contains all the user's scripts, flows and apps"
+		},
+		Runs: {
+			aiId: 'sidebar-menu-link-runs',
+			aiDescription: 'Button to navigate to runs',
+			onclick: () => {
+				setTimeout(() => {
+					window.dispatchEvent(new Event('popstate'))
+				}, 100)
 			}
-		].filter((l) => !excludeMainLabels.includes(l.label))
+		},
+		Variables: {
+			aiId: 'sidebar-menu-link-variables',
+			aiDescription: 'Button to navigate to variables'
+		},
+		Resources: {
+			aiId: 'sidebar-menu-link-resources',
+			aiDescription: 'Button to navigate to resources'
+		},
+		Assets: { aiId: 'sidebar-menu-link-assets', aiDescription: 'Button to navigate to assets' },
+		Folders: { aiId: 'sidebar-menu-link-folders', aiDescription: 'Button to navigate to folders' },
+		Groups: { aiId: 'sidebar-menu-link-groups', aiDescription: 'Button to navigate to groups' }
+	}
+	let mainMenuLinks = $derived(
+		NAV_PAGES.filter((p) => p.label in MAIN_MENU_EXTRAS)
+			.map((p) => ({
+				label: p.label,
+				href: p.path === '/' ? `${base}/` : `${base}${p.path}`,
+				icon: p.icon,
+				disabled: p.operatorKey ? !allows(p.operatorKey) : false,
+				...MAIN_MENU_EXTRAS[p.label]
+			}))
+			.filter((l) => !excludeMainLabels.includes(l.label))
 	)
 	let defaultExtraTriggerLinks = $derived([
 		{
 			label: 'HTTP',
 			href: '/routes',
 			icon: Route,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'http',
 			aiId: 'sidebar-menu-link-http',
 			aiDescription: 'Button to navigate to HTTP routes'
@@ -268,7 +248,7 @@
 			label: 'WebSockets',
 			href: '/websocket_triggers',
 			icon: Unplug,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'ws',
 			aiId: 'sidebar-menu-link-ws',
 			aiDescription: 'Button to navigate to websocket triggers'
@@ -277,7 +257,7 @@
 			label: 'Postgres',
 			href: '/postgres_triggers',
 			icon: Database,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'postgres',
 			aiId: 'sidebar-menu-link-postgres',
 			aiDescription: 'Button to navigate to Postgres triggers'
@@ -286,7 +266,7 @@
 			label: 'Kafka' + ($enterpriseLicense ? '' : ' (EE)'),
 			href: '/kafka_triggers',
 			icon: KafkaIcon,
-			disabled: $userStore?.operator || !$enterpriseLicense,
+			disabled: !allows('triggers') || !$enterpriseLicense,
 			kind: 'kafka',
 			aiId: 'sidebar-menu-link-kafka',
 			aiDescription: 'Button to navigate to Kafka triggers'
@@ -295,7 +275,7 @@
 			label: 'NATS' + ($enterpriseLicense ? '' : ' (EE)'),
 			href: '/nats_triggers',
 			icon: NatsIcon,
-			disabled: $userStore?.operator || !$enterpriseLicense,
+			disabled: !allows('triggers') || !$enterpriseLicense,
 			kind: 'nats',
 			aiId: 'sidebar-menu-link-nats',
 			aiDescription: 'Button to navigate to NATS triggers'
@@ -304,7 +284,7 @@
 			label: 'SQS' + ($enterpriseLicense ? '' : ' (EE)'),
 			href: '/sqs_triggers',
 			icon: AwsIcon,
-			disabled: $userStore?.operator || !$enterpriseLicense,
+			disabled: !allows('triggers') || !$enterpriseLicense,
 			kind: 'sqs',
 			aiId: 'sidebar-menu-link-sqs',
 			aiDescription: 'Button to navigate to SQS triggers'
@@ -313,7 +293,7 @@
 			label: 'GCP Pub/Sub' + ($enterpriseLicense ? '' : ' (EE)'),
 			href: '/gcp_triggers',
 			icon: GoogleCloudIcon,
-			disabled: $userStore?.operator || !$enterpriseLicense,
+			disabled: !allows('triggers') || !$enterpriseLicense,
 			kind: 'gcp',
 			aiId: 'sidebar-menu-link-gcp',
 			aiDescription: 'Button to navigate to GCP Pub/Sub triggers'
@@ -322,7 +302,7 @@
 			label: 'Azure Event Grid' + ($enterpriseLicense ? '' : ' (EE)'),
 			href: '/azure_triggers',
 			icon: AzureIcon,
-			disabled: $userStore?.operator || !$enterpriseLicense,
+			disabled: !allows('triggers') || !$enterpriseLicense,
 			kind: 'azure',
 			aiId: 'sidebar-menu-link-azure',
 			aiDescription: 'Button to navigate to Azure Event Grid triggers'
@@ -331,7 +311,7 @@
 			label: 'MQTT',
 			href: '/mqtt_triggers',
 			icon: MqttIcon,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'mqtt',
 			aiId: 'sidebar-menu-link-mqtt',
 			aiDescription: 'Button to navigate to MQTT triggers'
@@ -340,7 +320,7 @@
 			label: 'AMQP',
 			href: '/amqp_triggers',
 			icon: AmqpIcon,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'amqp',
 			aiId: 'sidebar-menu-link-amqp',
 			aiDescription: 'Button to navigate to AMQP triggers'
@@ -349,7 +329,7 @@
 			label: 'Email',
 			href: '/email_triggers',
 			icon: MailIcon,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'email',
 			aiId: 'sidebar-menu-link-email',
 			aiDescription: 'Button to navigate to Email triggers'
@@ -375,7 +355,7 @@
 			label: 'Schedules',
 			href: `${base}/schedules`,
 			icon: Calendar,
-			disabled: !SIDEBAR_SHOW_SCHEDULES || $userStore?.operator,
+			disabled: !SIDEBAR_SHOW_SCHEDULES || !allows('schedules'),
 			aiId: 'sidebar-menu-link-schedules',
 			aiDescription: 'Button to navigate to schedules'
 		},
@@ -390,7 +370,6 @@
 	)
 	// Admins, superadmins, and fork creators reach workspace settings (the latter
 	// for the fork members screen; see isForkOwner / backend authorize_fork_owner_add_user).
-	const currentWs = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
 	const canManageWorkspace = $derived(
 		$userStore?.is_admin || $superadmin || isForkOwner(currentWs, $userStore?.email)
 	)
@@ -460,7 +439,7 @@
 			label: 'Workers',
 			href: `${base}/workers`,
 			icon: ServerCog,
-			disabled: $userStore?.operator,
+			disabled: !allows('workers'),
 			aiId: 'sidebar-menu-link-workers',
 			aiDescription: 'Button to navigate to workers'
 		},
@@ -509,7 +488,7 @@
 					label: 'Audit logs',
 					href: `${base}/audit_logs`,
 					icon: Eye,
-					disabled: $userStore?.operator,
+					disabled: !allows('audit_logs'),
 					aiId: 'sidebar-menu-link-audit-logs',
 					aiDescription: 'Button to navigate to audit logs'
 				}
@@ -551,7 +530,7 @@
 								{#each triggerMenuLinks as menuLink (menuLink.href ?? menuLink.label)}
 									<MenuLink class="!text-xs" {...menuLink} {isCollapsed} />
 								{/each}
-								{#if extraTriggerLinks.length > 0 && !$userStore?.operator}
+								{#if extraTriggerLinks.length > 0 && allows('triggers')}
 									<Menu {createMenu} usePointerDownOutside>
 										{#snippet triggr({ trigger })}
 											<MeltButton
diff --git a/frontend/src/lib/components/sidebar/SwitchWorkspaceSubmenu.svelte b/frontend/src/lib/components/sidebar/SwitchWorkspaceSubmenu.svelte
deleted file mode 100644
index 1f9b4f410f..0000000000
--- a/frontend/src/lib/components/sidebar/SwitchWorkspaceSubmenu.svelte
+++ /dev/null
@@ -1,68 +0,0 @@
-<script lang="ts">
-	import { untrack } from 'svelte'
-	import { melt } from '@melt-ui/svelte'
-	import type { MenubarMenuBuilders, MenubarMenuElements } from '@melt-ui/svelte'
-	import { Building, ChevronRight } from 'lucide-svelte'
-	import { twMerge } from 'tailwind-merge'
-	import { sidebarClasses } from './MenuButton.svelte'
-	import WorkspacePickerBody from './WorkspacePickerBody.svelte'
-	import { MenuItem } from '$lib/components/meltComponents'
-	import { clearWorkspaceFromStorage } from '$lib/stores'
-	import { base } from '$lib/base'
-
-	interface Props {
-		// Submenu builders from the enclosing melt Menu — createSubmenu must be
-		// called against this specific menu instance (same pattern as DropdownSubmenuItem).
-		builders: MenubarMenuBuilders
-		// Melt uses the parent menu's item builder for submenu rows too, so the
-		// picker body's MenuItems work here unchanged.
-		item: MenubarMenuElements['item']
-	}
-
-	let { builders, item }: Props = $props()
-
-	const {
-		elements: { subTrigger, subMenu },
-		states: { subOpen }
-	} = untrack(() => builders).createSubmenu()
-</script>
-
-<button
-	use:melt={$subTrigger}
-	class={twMerge(
-		'flex flex-row gap-3.5 items-center px-2 py-2 w-full',
-		sidebarClasses.text,
-		'transition-colors',
-		'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-	)}
->
-	<Building size={14} class="shrink-0" />
-	<span class="grow text-left">Switch workspace</span>
-	<ChevronRight size={14} class="shrink-0 text-tertiary" />
-</button>
-
-{#if $subOpen}
-	<div
-		use:melt={$subMenu}
-		class="z-[6001] w-56 bg-surface border rounded-md shadow-md focus:outline-none"
-	>
-		<WorkspacePickerBody {item} strictWorkspaceSelect />
-		<!-- The picker's list scrolls inside itself, so this sits below it and stays reachable
-		     however many workspaces the operator belongs to. -->
-		<div class="border-t border-border-light" role="none">
-			<MenuItem
-				href="{base}/user/workspaces"
-				onClick={() => clearWorkspaceFromStorage()}
-				class={twMerge(
-					'w-full flex flex-row gap-2 px-4 py-2 font-normal',
-					sidebarClasses.text,
-					'hover:bg-surface-hover hover:text-primary',
-					'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-				)}
-				{item}
-			>
-				All workspaces
-			</MenuItem>
-		</div>
-	</div>
-{/if}
diff --git a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
index ddcbd9ca95..3902715d5a 100644
--- a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
+++ b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
@@ -14,9 +14,19 @@
 		createMenu: MenubarBuilders['createMenu']
 		// When used outside of the side bar, where links to workspace settings and such don't make as much sense.
 		strictWorkspaceSelect?: boolean
+		// Denser trigger for the page header bar: a smaller disc and a lighter name, so the
+		// workspace reads as the scope of the breadcrumb beside it rather than a heading.
+		compact?: boolean
 	}
 
-	let { isCollapsed = false, createMenu, strictWorkspaceSelect = false }: Props = $props()
+	let {
+		isCollapsed = false,
+		createMenu,
+		strictWorkspaceSelect = false,
+		compact = false
+	}: Props = $props()
+
+	let menu: Menu | undefined = $state(undefined)
 
 	// The active workspace's family root — shown in the trigger so a forked active workspace still
 	// surfaces its family name here (the fork itself is shown in the breadcrumb). Resolved exactly
@@ -29,7 +39,7 @@
 	const ambiguousNames = $derived(ambiguousWorkspaceNames($userWorkspaces))
 </script>
 
-<Menu {createMenu} usePointerDownOutside placement="bottom-start">
+<Menu bind:this={menu} {createMenu} usePointerDownOutside placement="bottom-start">
 	{#snippet triggr({ trigger })}
 		<!-- Family header reflects the family (root) color, not the active
 		     workspace's — switching into a fork must not recolor it. -->
@@ -41,7 +51,7 @@
 			name={currentFamily?.name ?? $workspaceStore ?? ''}
 			id={currentFamily?.id ?? $workspaceStore ?? ''}
 			disablePopup={isCollapsed}
-			class="block w-full"
+			class={compact ? 'block' : 'block w-full'}
 		>
 			<MenuButton
 				icon={Building}
@@ -53,8 +63,10 @@
 				{isCollapsed}
 				color={familyColor}
 				showChevron
-				emphasizeLabel
+				emphasizeLabel={!compact}
 				disableTitle
+				{compact}
+				labelClass={compact ? 'wm-workspace-name text-primary font-medium' : 'wm-workspace-name'}
 				{trigger}
 			/>
 		</NameIdTooltip>
@@ -63,6 +75,11 @@
 	{#snippet children({ item })}
 		<!-- The only strict caller is a standalone page (svix webhook creation) that owns its
 		     own navigation, so there a switch must leave the page where it is. -->
-		<WorkspacePickerBody {item} {strictWorkspaceSelect} keepPageOnSwitch={strictWorkspaceSelect} />
+		<WorkspacePickerBody
+			{item}
+			{strictWorkspaceSelect}
+			keepPageOnSwitch={strictWorkspaceSelect}
+			closeMenu={() => menu?.close()}
+		/>
 	{/snippet}
 </Menu>
diff --git a/frontend/src/lib/components/sidebar/WorkspacePickerBody.svelte b/frontend/src/lib/components/sidebar/WorkspacePickerBody.svelte
index fa4468fa6a..e25dc83286 100644
--- a/frontend/src/lib/components/sidebar/WorkspacePickerBody.svelte
+++ b/frontend/src/lib/components/sidebar/WorkspacePickerBody.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { untrack } from 'svelte'
+	import { tick, untrack } from 'svelte'
 	import type { MenubarMenuElements } from '@melt-ui/svelte'
 	import { workspaceMenuHref } from './workspaceMenuHref'
 	import { isOperatorInWorkspace } from './operatorRoutes'
@@ -18,7 +18,7 @@
 	import { Check, ChevronDown, ChevronRight, Plus, Settings } from 'lucide-svelte'
 	import { forkAccentStyle } from '$lib/utils/forkColor'
 	import { SvelteSet } from 'svelte/reactivity'
-	import { Badge, CopyButton } from '$lib/components/common'
+	import { CopyButton } from '$lib/components/common'
 	import { MenuItem, Tooltip } from '$lib/components/meltComponents'
 	import { EXECUTIONS_HINT } from './executionsHint'
 	import WorkspaceIcon from '$lib/components/workspace/WorkspaceIcon.svelte'
@@ -39,7 +39,7 @@
 	} from '$lib/utils/workspaceHierarchy'
 	import { canCreateFork } from '$lib/utils/editInFork'
 	import { workspaceRootId } from '$lib/components/sessions/sessionScope.svelte'
-	import { devBadgeText } from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 
 	interface Props {
 		// The melt item builder of the menu (or submenu) hosting this list. Melt
@@ -48,14 +48,26 @@
 		item: MenubarMenuElements['item']
 		// When used outside of the side bar, where links to workspace settings and such don't make as much sense.
 		strictWorkspaceSelect?: boolean
+		/** Closes the menu this list lives in, so a workspace switch does not run under an open
+		 *  panel. The host owns the menu, so only it can. */
+		closeMenu?: () => void
 		// Set by a picker embedded in a page that drives its own navigation, so switching
 		// workspaces must not navigate away from it. Separate from strictWorkspaceSelect,
-		// which only strips the sidebar-specific rows — the operator submenu sets that one
-		// and still wants the switch to move the page.
+		// which only strips the sidebar-specific rows.
 		keepPageOnSwitch?: boolean
+		/** Opens with every family closed, forks included. For a picker whose job is to move between
+		 *  families rather than within one — a session's, where the fork is the session's own and
+		 *  not something the picker should offer to change. */
+		collapseFamilies?: boolean
 	}
 
-	let { item, strictWorkspaceSelect = false, keepPageOnSwitch = false }: Props = $props()
+	let {
+		item,
+		strictWorkspaceSelect = false,
+		keepPageOnSwitch = false,
+		collapseFamilies = false,
+		closeMenu
+	}: Props = $props()
 
 	async function toggleSwitchWorkspace(id: string) {
 		if ($workspaceStore === id) {
@@ -107,8 +119,13 @@
 		if (e.ctrlKey || e.metaKey || e.shiftKey || e.altKey) {
 			return
 		}
+		// This click is handled here rather than by melt, so melt never closes the menu for it and
+		// the panel would sit through the switch — which renames the workspace in the header,
+		// moving the very trigger the panel hangs from, with floating-ui chasing it across the
+		// viewport. Close first, let that reach the DOM, then switch.
 		e.preventDefault()
-		toggleSwitchWorkspace(workspace.id)
+		closeMenu?.()
+		void tick().then(() => toggleSwitchWorkspace(workspace.id))
 	}
 
 	// Family-first picker: list the workspace families (roots) with their forks
@@ -117,7 +134,7 @@
 	// scope header's WorkspaceFamilyPicker remains the primary fork surface.
 	//
 	// strictWorkspaceSelect is used where this list has no scope header beside it
-	// (standalone pages such as svix webhook creation, the operator menu), so
+	// (standalone pages such as svix webhook creation), so
 	// there forks must stay directly selectable — list the full hierarchy
 	// unconditionally.
 	const hierarchy = $derived($userWorkspaces ? buildWorkspaceHierarchy($userWorkspaces) : [])
@@ -140,16 +157,41 @@
 	const canForkHere = $derived(
 		(!isCloudHosted() || $maybePremium) && $workspaceStore !== 'admins' && canCreateFork($userStore)
 	)
+	// The row mechanics below — which family to expand, which collapsed row carries the tick — key on
+	// a depth-0 row of the list, which `buildWorkspaceHierarchy` puts at the highest workspace the
+	// caller can see: parentless, or with a parent absent from their list. `findWorkspaceAncestors`
+	// stops at that same visibility boundary, so it lands on the same row.
+	const lineageRoot = $derived.by(() => {
+		const id = $workspaceStore ?? undefined
+		if (!id) return undefined
+		const ancestors = findWorkspaceAncestors(id, $userWorkspaces ?? [])
+		return ancestors.at(-1) ?? $userWorkspaces?.find((w) => w.id === id)
+	})
+
 	const familyWorkspaces = $derived.by(() => {
-		if (strictWorkspaceSelect) return hierarchy
 		let rootId: string | undefined
-		return hierarchy.filter((h) => {
-			if (h.depth === 0) {
-				rootId = h.workspace.id
-				return true
-			}
-			return !!rootId && expandedFamilies.has(rootId)
-		})
+		const visible = strictWorkspaceSelect
+			? hierarchy
+			: hierarchy.filter((h) => {
+					if (h.depth === 0) {
+						rootId = h.workspace.id
+						return true
+					}
+					return !!rootId && expandedFamilies.has(rootId)
+				})
+		// The family the user is standing in leads the list, its forks travelling with it: the
+		// workspace they are in is the one they look for first, and the one the tick is on.
+		const activeRoot = lineageRoot?.id
+		if (!activeRoot) return visible
+		const families: { root: string | undefined; rows: typeof visible }[] = []
+		for (const h of visible) {
+			if (h.depth === 0 || families.length === 0) families.push({ root: h.workspace.id, rows: [h] })
+			else families[families.length - 1].rows.push(h)
+		}
+		const at = families.findIndex((f) => f.root === activeRoot)
+		if (at <= 0) return visible
+		const [active] = families.splice(at, 1)
+		return [active, ...families].flatMap((f) => f.rows)
 	})
 
 	// ArrowRight/ArrowLeft expand/collapse the keyboard-highlighted family (melt
@@ -173,27 +215,13 @@
 		e.stopPropagation()
 	}
 
-	// The row mechanics below — which family to expand, which collapsed row carries the tick — key on
-	// a depth-0 row of the list, which `buildWorkspaceHierarchy` puts at the highest workspace the
-	// caller can see: parentless, or with a parent absent from their list. `findWorkspaceAncestors`
-	// stops at that same visibility boundary, so it lands on the same row.
-	const lineageRoot = $derived.by(() => {
-		const id = $workspaceStore ?? undefined
-		if (!id) return undefined
-		const ancestors = findWorkspaceAncestors(id, $userWorkspaces ?? [])
-		return ancestors.at(-1) ?? $userWorkspaces?.find((w) => w.id === id)
-	})
-
 	const ambiguousNames = $derived(ambiguousWorkspaceNames($userWorkspaces))
 
-	// Seeded once per instance: opening while a fork is active expands that fork's family,
-	// putting the tick on the active fork's own row instead of on its collapsed root. The
-	// host menu renders this only while open, so in practice each open gets a fresh
-	// instance and therefore a fresh expansion state — except across a close and re-open
-	// inside the menu's 100ms outro, where Svelte resumes the same instance and whatever
-	// was expanded by hand survives.
+	// Seeded once per instance: the family the user is standing in opens expanded, so its forks —
+	// the ones they are most likely to switch between — are there without a click, and the tick
+	// sits on the actual workspace rather than on its collapsed root. Other families stay closed.
 	untrack(() => {
-		if (lineageRoot && lineageRoot.id !== $workspaceStore) {
+		if (!collapseFamilies && lineageRoot && familiesWithForks.has(lineageRoot.id)) {
 			expandedFamilies.add(lineageRoot.id)
 		}
 	})
@@ -281,12 +309,12 @@
 										{workspace.name}{workspace.disabled ? ' (user disabled)' : ''}
 									</div>
 									{#if workspace.is_dev_workspace}
-										<Badge
-											color="dark-blue"
-											small
-											class="text-3xs px-1 py-0 dark:bg-surface-accent-primary text-white dark:text-white"
-											>{devBadgeText(workspace.dev_workspace_label)}</Badge
-										>
+										<DevWorkspaceBadge
+											label={workspace.dev_workspace_label}
+											color={workspace.color}
+											fallbackClass="dark:bg-surface-accent-primary text-white dark:text-white"
+											class="text-3xs px-1 py-0"
+										/>
 									{/if}
 								</div>
 								{#if ambiguousNames.has(workspace.name)}
@@ -345,11 +373,7 @@
 				</MenuItem>
 			{/if}
 			{#if canForkHere}
-				<MenuItem
-					class={itemClass}
-					onClick={() => (globalForkModal.val = { opened: true })}
-					{item}
-				>
+				<MenuItem class={itemClass} onClick={() => (globalForkModal.val = { opened: true })} {item}>
 					<Plus size={16} />
 					Workspace fork
 				</MenuItem>
diff --git a/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte b/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte
index 31762045f1..aae6e4ce2a 100644
--- a/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte
+++ b/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte
@@ -19,7 +19,10 @@
 	} from '$lib/utils/workspaceHierarchy'
 	import { useForkableWorkspaces } from '$lib/utils/useForkableWorkspaces.svelte'
 
-	let { isCollapsed = false }: { isCollapsed?: boolean } = $props()
+	// `compact` is the page header's variant: sized to its label on one line, rather than filling
+	// a rail's width.
+	let { isCollapsed = false, compact = false }: { isCollapsed?: boolean; compact?: boolean } =
+		$props()
 
 	const effectiveId = $derived($workspaceStore ?? undefined)
 	// Resolve once here and pass to the picker + trigger below, avoiding a duplicate lookup (see
@@ -62,7 +65,11 @@
 	}
 </script>
 
-<div class="flex items-center min-w-0 px-2 {isCollapsed ? 'justify-center' : ''} py-0.5 rounded-md">
+<div
+	class="flex items-center min-w-0 {compact ? '' : 'px-2'} {isCollapsed
+		? 'justify-center'
+		: ''} py-0.5 rounded-md"
+>
 	<WorkspaceFamilyPicker
 		selectedId={effectiveId}
 		{forkableWorkspaces}
@@ -70,7 +77,7 @@
 		onRequestCreateFork={openForkModal}
 		{settingsHref}
 		{settingsLabel}
-		class="min-w-0 w-full"
+		class={compact ? 'min-w-0' : 'min-w-0 w-full'}
 	>
 		{#snippet trigger()}
 			<WorkspaceScopeTrigger
@@ -78,8 +85,8 @@
 				{forkableWorkspaces}
 				{isCollapsed}
 				{rootLabel}
-				wrap
-				class="w-full"
+				wrap={!compact}
+				class={compact ? '' : 'w-full'}
 			/>
 		{/snippet}
 	</WorkspaceFamilyPicker>
diff --git a/frontend/src/lib/components/sidebar/navDetached.svelte.ts b/frontend/src/lib/components/sidebar/navDetached.svelte.ts
new file mode 100644
index 0000000000..19568eaddc
--- /dev/null
+++ b/frontend/src/lib/components/sidebar/navDetached.svelte.ts
@@ -0,0 +1,28 @@
+import { fromStore } from 'svelte/store'
+import { userStore } from '$lib/stores'
+import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
+
+// One preference per role rather than one per account. The same person is both — an operator in
+// one workspace, a developer in the next — and the two want different things from the sidebar, so
+// a single key would carry whichever was pressed last into the other role and never give it back.
+// Empty until that role presses detach or attach once.
+const operatorPref = useLocalStorageValue<string>('nav_detached_operator', '', 'string')
+const devPref = useLocalStorageValue<string>('nav_detached_dev', '', 'string')
+const user = fromStore(userStore)
+
+/** Whether the sidebar is detached: hidden behind a floating button that slides it in over the page. */
+export const navDetached = {
+	get val(): boolean {
+		// Unasked, operators start detached: many of them navigate through a workspace's own app,
+		// and a docked sidebar would take its width.
+		const operator = !!user.current?.operator
+		const pref = operator ? operatorPref : devPref
+		if (pref.val === 'true') return true
+		if (pref.val === 'false') return false
+		return operator
+	},
+	set val(detached: boolean) {
+		const pref = user.current?.operator ? operatorPref : devPref
+		pref.val = String(detached)
+	}
+}
diff --git a/frontend/src/lib/components/sidebar/navHandlePlacement.svelte.ts b/frontend/src/lib/components/sidebar/navHandlePlacement.svelte.ts
new file mode 100644
index 0000000000..5fb7b43860
--- /dev/null
+++ b/frontend/src/lib/components/sidebar/navHandlePlacement.svelte.ts
@@ -0,0 +1,50 @@
+import { BAR_HEIGHT_PX } from '../pageHeaderRegistry.svelte'
+
+// Opening the detached sidebar's card, from the band's own handle or from the corner control that
+// stands in for it on a page which hides the band.
+let opener: (() => void) | undefined
+// Closing it once the pointer is off both the handle and the card, which the layout owns because
+// the card is its markup.
+let hoverClose: { schedule: () => void; cancel: () => void } | undefined
+
+// Where the card's top edge goes: the header's bottom edge, so the two meet in a line rather than
+// the card starting at whatever height the control that opened it happens to have. Measured at open
+// time rather than fixed, so the card follows the header's own height. On a page that hides the
+// header, the header is still what the card will sit under — it comes down with it — so its height
+// is read even while it is off-screen. The fallback matches the header's resting height.
+const FALLBACK_CARD_TOP = BAR_HEIGHT_PX
+const GAP_UNDER_HANDLE = 6
+let cardTop = $state(FALLBACK_CARD_TOP)
+
+export const navHandleSlot = {
+	/** Distance from the top of the viewport to the card's top edge, in px. */
+	get cardTop(): number {
+		return cardTop
+	},
+	/** The root layout owns the card, so it registers how to open and hover-close it. */
+	setOpener(open: () => void, close?: { schedule: () => void; cancel: () => void }) {
+		opener = open
+		hoverClose = close
+	},
+	/** Pointer left the handle: close, unless it lands on the card before the delay is up. */
+	scheduleClose() {
+		hoverClose?.schedule()
+	},
+	/**
+	 * Opens the card under the page header, or under `anchor` when there is no header to sit
+	 * beneath — an embed, where whatever reached for the nav is all the card has to hang from.
+	 */
+	open(anchor?: Element | null) {
+		hoverClose?.cancel()
+		const band = document.querySelector('[data-page-header]')
+		const bandHeight = band?.getBoundingClientRect().height
+		if (bandHeight) {
+			cardTop = Math.round(bandHeight)
+		} else {
+			const bottom = anchor?.getBoundingClientRect().bottom
+			cardTop =
+				bottom != null && bottom > 0 ? Math.round(bottom) + GAP_UNDER_HANDLE : FALLBACK_CARD_TOP
+		}
+		opener?.()
+	}
+}
diff --git a/frontend/src/lib/components/sidebar/navPages.test.ts b/frontend/src/lib/components/sidebar/navPages.test.ts
new file mode 100644
index 0000000000..6e68912a15
--- /dev/null
+++ b/frontend/src/lib/components/sidebar/navPages.test.ts
@@ -0,0 +1,24 @@
+import { describe, it, expect } from 'vitest'
+import { navPageFor } from './navPages'
+
+describe('navPageFor', () => {
+	it('names the page a route belongs to, under the app base', () => {
+		expect(navPageFor('/base/runs', '/base')?.label).toBe('Runs')
+	})
+
+	it('keeps an item route on its page', () => {
+		expect(navPageFor('/runs/f/demo/x', '')?.label).toBe('Runs')
+	})
+
+	it('does not let Home swallow every route', () => {
+		expect(navPageFor('/audit_logs', '')?.label).toBe('Audit logs')
+		expect(navPageFor('/', '')?.label).toBe('Home')
+	})
+
+	it('falls back to the first segment for a route the table does not name', () => {
+		expect(navPageFor('/service_logs/x', '')).toMatchObject({
+			label: 'Service logs',
+			path: '/service_logs'
+		})
+	})
+})
diff --git a/frontend/src/lib/components/sidebar/navPages.ts b/frontend/src/lib/components/sidebar/navPages.ts
new file mode 100644
index 0000000000..b9dc2eff63
--- /dev/null
+++ b/frontend/src/lib/components/sidebar/navPages.ts
@@ -0,0 +1,68 @@
+import {
+	Boxes,
+	Calendar,
+	DollarSign,
+	Eye,
+	FolderOpen,
+	Home,
+	HardHat,
+	Play,
+	Pyramid,
+	Unplug,
+	Users
+} from 'lucide-svelte'
+import type { OperatorPageKey } from './operatorRoutes'
+
+/**
+ * The names the page header's breadcrumb gives the workspace's own pages, and the rows the
+ * sidebar's main group is built from.
+ *
+ * Every entry names a page for the breadcrumb, and its `icon` goes there too. Only the entries
+ * `SidebarContent`'s `MAIN_MENU_EXTRAS` also lists become sidebar links from here — Schedules,
+ * HTTP routes, Workers and Audit logs are grouped differently there and carry their own row, so
+ * for those four the `operatorKey` below goes unread. Keep the labels in step with those rows by
+ * hand.
+ */
+export type NavPage = {
+	label: string
+	/** Path under `base`, matched against the current route by longest prefix. */
+	path: string
+	icon: any
+	/** The `operator_settings` key that admits an operator, when the page has one. */
+	operatorKey?: OperatorPageKey
+}
+
+export const NAV_PAGES: NavPage[] = [
+	{ label: 'Home', path: '/', icon: Home },
+	{ label: 'Runs', path: '/runs', icon: Play, operatorKey: 'runs' },
+	{ label: 'Variables', path: '/variables', icon: DollarSign, operatorKey: 'variables' },
+	{ label: 'Resources', path: '/resources', icon: Boxes, operatorKey: 'resources' },
+	{ label: 'Assets', path: '/assets', icon: Pyramid, operatorKey: 'assets' },
+	{ label: 'Folders', path: '/folders', icon: FolderOpen, operatorKey: 'folders' },
+	{ label: 'Groups', path: '/groups', icon: Users, operatorKey: 'groups' },
+	{ label: 'Schedules', path: '/schedules', icon: Calendar, operatorKey: 'schedules' },
+	// "Triggers" is the group the sidebar files this under, not the page: the row there reads HTTP.
+	{ label: 'HTTP routes', path: '/routes', icon: Unplug, operatorKey: 'triggers' },
+	{ label: 'Workers', path: '/workers', icon: HardHat, operatorKey: 'workers' },
+	{ label: 'Audit logs', path: '/audit_logs', icon: Eye, operatorKey: 'audit_logs' }
+]
+
+/**
+ * The page a route belongs to. Longest match wins, so `/runs/f/demo/x` is still Runs, and a route
+ * the table does not name falls back to its first segment (`/service_logs` → "Service logs").
+ */
+export function navPageFor(pathname: string, base: string): NavPage | undefined {
+	const path = pathname.startsWith(base) ? pathname.slice(base.length) || '/' : pathname
+	const match = NAV_PAGES.filter(
+		(p) => p.path === path || (p.path !== '/' && path.startsWith(p.path + '/'))
+	).sort((a, b) => b.path.length - a.path.length)[0]
+	if (match) return match
+	const first = path.split('/').filter(Boolean)[0]
+	if (!first) return undefined
+	const label = first.replace(/_/g, ' ')
+	return {
+		label: label.charAt(0).toUpperCase() + label.slice(1),
+		path: `/${first}`,
+		icon: undefined
+	}
+}
diff --git a/frontend/src/lib/components/sidebar/operatorRoutes.test.ts b/frontend/src/lib/components/sidebar/operatorRoutes.test.ts
new file mode 100644
index 0000000000..bf14926d00
--- /dev/null
+++ b/frontend/src/lib/components/sidebar/operatorRoutes.test.ts
@@ -0,0 +1,26 @@
+import { describe, it, expect } from 'vitest'
+import { sidebarPageAllowed } from './operatorRoutes'
+import type { UserWorkspace } from '$lib/stores'
+
+const ws = (operator_settings: any): UserWorkspace =>
+	({ id: 'w', name: 'w', username: 'u', operator_settings }) as UserWorkspace
+
+describe('sidebarPageAllowed', () => {
+	it('shows every page to anyone who is not an operator', () => {
+		expect(sidebarPageAllowed(false, ws(null), 'runs')).toBe(true)
+		expect(sidebarPageAllowed(undefined, undefined, 'runs')).toBe(true)
+	})
+
+	it('admits an operator only where the workspace turned the page on', () => {
+		expect(sidebarPageAllowed(true, ws({ runs: true }), 'runs')).toBe(true)
+		expect(sidebarPageAllowed(true, ws({ runs: false }), 'runs')).toBe(false)
+	})
+
+	it('withholds a page the settings do not mention', () => {
+		// `=== true`, not truthiness: a right absent from the jsonb, or settings that were never
+		// written, must not read as granted.
+		expect(sidebarPageAllowed(true, ws({ variables: true }), 'runs')).toBe(false)
+		expect(sidebarPageAllowed(true, ws(null), 'runs')).toBe(false)
+		expect(sidebarPageAllowed(true, undefined, 'runs')).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/components/sidebar/operatorRoutes.ts b/frontend/src/lib/components/sidebar/operatorRoutes.ts
index 1abd7aeb93..6824c36c62 100644
--- a/frontend/src/lib/components/sidebar/operatorRoutes.ts
+++ b/frontend/src/lib/components/sidebar/operatorRoutes.ts
@@ -1,61 +1,41 @@
-import { base } from '$lib/base'
+import type { OperatorSettings } from '$lib/gen'
 import type { UserWorkspace } from '$lib/stores'
 
 /**
- * The pages an operator can reach, each paired with the `operator_settings` key
- * that admits them — the operator menu lists only the entries the active
- * workspace permits.
+ * An `operator_settings` key that admits an operator to one page (`triggers` to all of them).
+ *
+ * Only the visibility flags: the same object also carries the write rights `builder_flows`,
+ * `manage_schedules` and `manage_triggers`, which the `=== true` rule below answers wrongly. A
+ * write right is granted unless withdrawn, so its absence means "never configured" rather than
+ * "no" — see `docs/operator-write-rights.md`.
  */
-export type OperatorMenuLink = {
-	label: string
-	/** `operator_settings` key gating the page. */
-	id: string
-	href: string
+export type OperatorPageKey = Extract<
+	keyof NonNullable<OperatorSettings>,
+	| 'runs'
+	| 'schedules'
+	| 'resources'
+	| 'variables'
+	| 'assets'
+	| 'audit_logs'
+	| 'triggers'
+	| 'groups'
+	| 'folders'
+	| 'workers'
+>
+
+/**
+ * Whether the sidebar shows the page behind `key`. Everyone but an operator sees every page
+ * (other gates, such as admin-only entries, still apply); an operator sees only the pages the
+ * workspace's `operator_settings` turn on.
+ */
+export function sidebarPageAllowed(
+	isOperator: boolean | undefined,
+	workspace: UserWorkspace | undefined,
+	key: OperatorPageKey
+): boolean {
+	return !isOperator || workspace?.operator_settings?.[key] === true
 }
 
-export type OperatorTriggerLink = OperatorMenuLink & { kind: string }
-
-/** Home needs no setting — it is the one page every operator always has. */
-export const OPERATOR_MAIN_LINKS: OperatorMenuLink[] = [
-	{ label: 'Home', id: 'home', href: `${base}/` },
-	{ label: 'Runs', id: 'runs', href: `${base}/runs` },
-	{ label: 'Schedules', id: 'schedules', href: `${base}/schedules` }
-]
-
-export const OPERATOR_SECONDARY_LINKS: OperatorMenuLink[] = [
-	{ label: 'Resources', id: 'resources', href: `${base}/resources` },
-	{ label: 'Variables', id: 'variables', href: `${base}/variables` },
-	{ label: 'Assets', id: 'assets', href: `${base}/assets` },
-	{ label: 'Groups', id: 'groups', href: `${base}/groups` },
-	{ label: 'Folders', id: 'folders', href: `${base}/folders` },
-	{ label: 'Workers', id: 'workers', href: `${base}/workers` },
-	{ label: 'Audit logs', id: 'audit_logs', href: `${base}/audit_logs` }
-]
-
-export const OPERATOR_TRIGGER_LINKS: OperatorTriggerLink[] = [
-	{ label: 'Custom HTTP routes', id: 'triggers', href: `${base}/routes`, kind: 'http' },
-	{ label: 'Websocket triggers', id: 'triggers', href: `${base}/websocket_triggers`, kind: 'ws' },
-	{
-		label: 'Postgres triggers',
-		id: 'triggers',
-		href: `${base}/postgres_triggers`,
-		kind: 'postgres'
-	},
-	{ label: 'Kafka triggers', id: 'triggers', href: `${base}/kafka_triggers`, kind: 'kafka' },
-	{ label: 'NATS triggers', id: 'triggers', href: `${base}/nats_triggers`, kind: 'nats' },
-	{ label: 'SQS triggers', id: 'triggers', href: `${base}/sqs_triggers`, kind: 'sqs' },
-	{ label: 'GCP Pub/Sub triggers', id: 'triggers', href: `${base}/gcp_triggers`, kind: 'gcp' },
-	{
-		label: 'Azure Event Grid triggers',
-		id: 'triggers',
-		href: `${base}/azure_triggers`,
-		kind: 'azure'
-	},
-	{ label: 'MQTT triggers', id: 'triggers', href: `${base}/mqtt_triggers`, kind: 'mqtt' },
-	{ label: 'AMQP triggers', id: 'triggers', href: `${base}/amqp_triggers`, kind: 'amqp' },
-	{ label: 'Email triggers', id: 'triggers', href: `${base}/email_triggers`, kind: 'email' }
-]
-
 /**
  * Whether the user is an operator in `workspace`. The server nulls
  * `operator_settings` for a non-operator, so a non-null value narrows an operator
diff --git a/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts b/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts
index df8e668fba..24925f2198 100644
--- a/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts
+++ b/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts
@@ -46,6 +46,43 @@ describe('workspaceMenuHref', () => {
 		).toBe('/runs?workspace=w')
 	})
 
+	// The compare page reads the workspace it compares from `workspace_id`, so a switch that
+	// left it behind sent the page back to the workspace just left on the next reload.
+	it('swaps workspace_id alongside workspace', () => {
+		expect(
+			workspaceMenuHref({
+				pathname: '/forks/compare',
+				searchParams: new URLSearchParams('workspace_id=wm-fork-a&mode=fork'),
+				id: 'wm-fork-b',
+				sameFamily: true
+			})
+		).toBe('/forks/compare?workspace_id=wm-fork-b&mode=fork&workspace=wm-fork-b')
+	})
+
+	it('does not add workspace_id to a page that had none', () => {
+		expect(
+			workspaceMenuHref({
+				pathname: '/runs',
+				searchParams: new URLSearchParams('job=123'),
+				id: 'w',
+				sameFamily: true
+			})
+		).toBe('/runs?job=123&workspace=w')
+	})
+
+	// `target` is the compare page's one-off migration destination, picked for the workspace
+	// being left. Carried over it can point the new workspace at itself.
+	it('drops an arbitrary compare target', () => {
+		expect(
+			workspaceMenuHref({
+				pathname: '/forks/compare',
+				searchParams: new URLSearchParams('workspace_id=wm-fork-a&target=wm-fork-b&mode=fork'),
+				id: 'wm-fork-b',
+				sameFamily: true
+			})
+		).toBe('/forks/compare?workspace_id=wm-fork-b&mode=fork&workspace=wm-fork-b')
+	})
+
 	// An operator lands on home in the workspace they switch into. The href has to carry
 	// that too, not just the click handler: this is what a middle-click opens.
 	it('points at home, dropping the current page and its params, when landOnHome is set', () => {
diff --git a/frontend/src/lib/components/sidebar/workspaceMenuHref.ts b/frontend/src/lib/components/sidebar/workspaceMenuHref.ts
index 57342f2b08..589326c0f6 100644
--- a/frontend/src/lib/components/sidebar/workspaceMenuHref.ts
+++ b/frontend/src/lib/components/sidebar/workspaceMenuHref.ts
@@ -24,6 +24,17 @@ export function workspaceMenuHref(args: {
 	}
 	const params = new URLSearchParams(args.searchParams)
 	params.set('workspace', args.id)
+	// `workspace_id` names the workspace a page acts on rather than the one the app is pointed at
+	// — the compare page's source. A switch moves it too, or the link lands on a page still
+	// working on the workspace just left. Only rewritten, never added: a page that does not use
+	// it has no business gaining it.
+	if (params.has('workspace_id')) {
+		params.set('workspace_id', args.id)
+	}
+	// The compare page's one-off migration destination, chosen for the workspace being left. Kept,
+	// it would survive into a workspace it was never picked for — including the target itself,
+	// leaving that page comparing a workspace with itself.
+	params.delete('target')
 	if (!args.sameFamily) {
 		params.delete('session')
 		params.delete('session_name')
diff --git a/frontend/src/lib/components/sidebar/workspaceSwitchUrl.ts b/frontend/src/lib/components/sidebar/workspaceSwitchUrl.ts
index 82130e3f95..c8bc6d070c 100644
--- a/frontend/src/lib/components/sidebar/workspaceSwitchUrl.ts
+++ b/frontend/src/lib/components/sidebar/workspaceSwitchUrl.ts
@@ -1,13 +1,20 @@
 import { page } from '$app/state'
-import { replaceState } from '$app/navigation'
 import { goto } from '$lib/navigation'
 
 // Post-workspace-switch URL fixup shared by the sidebar workspace pickers.
 // Item-scoped pages would show a wrong-workspace (or missing) item after a
-// switch — go home instead. Otherwise, really rewrite a ?workspace= param in
-// the address bar (mutating page.url is a no-op there): left stale, it gets
-// re-applied on reload or when exiting session mode restores the route,
+// switch — go home instead. Otherwise, really rewrite the params in the address
+// bar that name a workspace (mutating page.url is a no-op there): left stale,
+// they get re-applied on reload or when exiting session mode restores the route,
 // silently switching the workspace back.
+//
+// `workspace_id` names the workspace a page acts on (the compare page's pair) and
+// `workspace` the one the app is pointed at; a switch moves both. `target`, the
+// compare page's one-off migration destination, is dropped instead of rewritten:
+// it was chosen for the workspace being left, and keeping it could point the new
+// one at itself.
+const WORKSPACE_PARAMS = ['workspace', 'workspace_id']
+const STALE_AFTER_SWITCH = ['target']
 const EDIT_PAGES = [
 	'/scripts/edit/',
 	'/flows/edit/',
@@ -28,9 +35,32 @@ export async function fixupUrlAfterWorkspaceSwitch(
 ): Promise<void> {
 	if (EDIT_PAGES.some((p) => page.route.id?.includes(p) ?? false) || opts?.landOnHome) {
 		await goto('/')
-	} else if (page.url.searchParams.get('workspace')) {
-		const url = new URL(window.location.href)
-		url.searchParams.set('workspace', id)
-		replaceState(url, page.state)
+		return
 	}
+	// `window.location`, never `page.url`: a param written by a previous shallow update
+	// is in the address bar but not in `page.url`, so rebuilding from it would undo that
+	// write (see the note on `setQuery` in $lib/navigation).
+	const url = new URL(window.location.href)
+	let changed = false
+	for (const key of WORKSPACE_PARAMS) {
+		if (url.searchParams.get(key) === id) continue
+		if (!url.searchParams.has(key)) continue
+		url.searchParams.set(key, id)
+		changed = true
+	}
+	for (const key of STALE_AFTER_SWITCH) {
+		if (!url.searchParams.has(key)) continue
+		url.searchParams.delete(key)
+		changed = true
+	}
+	if (!changed) return
+	// `goto` rather than `replaceState`: a page reading these params through `page.url`
+	// (the compare page derives the workspace it compares from them) sees nothing when
+	// they are written shallowly, since SvelteKit refreshes `page.url` only on a
+	// router-driven navigation.
+	await goto(`${url.pathname}${url.search}${url.hash}`, {
+		replaceState: true,
+		noScroll: true,
+		keepFocus: true
+	})
 }
diff --git a/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte b/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
index ab8b850fa2..06922895df 100644
--- a/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
+++ b/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
@@ -40,6 +40,7 @@
 		 * editor has to pass it: every other editor renders with a `trigger`,
 		 * whose `type` is the same value. */
 		triggerKind?: TriggerType
+		saveLabel?: string
 	}
 
 	let {
@@ -60,7 +61,8 @@
 		suspendedJobsModal,
 		disableSuspendedMode = false,
 		triggerPath,
-		triggerKind
+		triggerKind,
+		saveLabel = 'Save'
 	}: Props = $props()
 	const operatingWorkspace = useOperatingWorkspace()
 	const wsId = $derived($operatingWorkspace)
@@ -120,7 +122,7 @@
 			}}
 			loading={isLoading}
 		>
-			Save
+			{saveLabel}
 		</Button>
 	{/if}
 {:else}
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte
index 9c3ec78ae3..055e9b3be3 100644
--- a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: AmqpTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
index 7346e285f6..211a2e13b4 100644
--- a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
@@ -172,12 +172,17 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
@@ -212,8 +217,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		defaultValues?: Record<string, any>
+		defaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100)
@@ -243,6 +254,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			clearTimeout(loadingTimeout)
 			drawerLoading = false
@@ -335,6 +347,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = getSaveCfg()
@@ -431,7 +448,9 @@
 			? can_write
 				? `Edit AMQP trigger ${initialPath}`
 				: `AMQP trigger ${initialPath}`
-			: 'New AMQP trigger'}
+			: saveDraftHandler
+				? 'Draft AMQP trigger'
+				: 'New AMQP trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -489,6 +508,7 @@
 			isLoading={deploymentLoading}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			onToggleMode={handleToggleMode}
diff --git a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
index 4394a5878f..ed0049168e 100644
--- a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
@@ -35,6 +35,7 @@
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
 	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import { base } from '$lib/base'
 	import Tabs from '$lib/components/common/tabs/Tabs.svelte'
 	import Tab from '$lib/components/common/tabs/Tab.svelte'
@@ -83,7 +84,7 @@
 	let permissionedAs = $state<string | undefined>(undefined)
 	let selectedPermissionedAs = $state<string | undefined>(undefined)
 	let preservePermissionedAs = $state(false)
-	let base_endpoint = $derived(`${window.location.origin}${base}`)
+	let base_endpoint = $derived(apiBaseUrl())
 
 	let optionTabSelected: 'error_handler' | 'retries' = $state('error_handler')
 	let errorHandlerSelected: ErrorHandler = $state('slack')
@@ -320,7 +321,9 @@
 			topic_name,
 			subscription_name,
 			event_type_filters,
-			base_endpoint,
+			// The capture URL shown to the user stays on the browsing origin, so the
+			// endpoint registered for it must too.
+			base_endpoint: `${window.location.origin}${base}`,
 			path
 		}
 	}
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerEditor.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerEditor.svelte
index 101b84f770..57ed70f6e7 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerEditor.svelte
@@ -27,6 +27,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: EmailTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
index 042b914b93..ae44a59e6a 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
@@ -139,12 +139,17 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Partial<NewEmailTrigger>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
 		drawerLoading = true
@@ -188,8 +193,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		defaultValues?: Partial<EmailTrigger>
+		defaultValues?: Partial<EmailTrigger>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		drawerLoading = true
 		let loader = setTimeout(() => {
 			showLoader = true
@@ -218,6 +229,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig as Partial<EmailTrigger>)
 		} finally {
 			clearTimeout(loader)
 			drawerLoading = false
@@ -276,6 +288,11 @@
 	}
 
 	async function triggerScript(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getEmailTriggerConfig()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		if (customSaveBehavior) {
 			customSaveBehavior(emailConfig)
 			drawer?.closeDrawer()
@@ -502,6 +519,7 @@
 			{edit}
 			isLoading={deploymentLoading}
 			onUpdate={triggerScript}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			{isDeployed}
@@ -521,7 +539,9 @@
 			? can_write
 				? `Edit email trigger ${initialPath}`
 				: `Email trigger ${initialPath}`
-			: 'New email trigger'}
+			: saveDraftHandler
+				? 'Draft email trigger'
+				: 'New email trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditor.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditor.svelte
index f86706e8ab..9c3111b0fb 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditor.svelte
@@ -22,6 +22,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: GcpTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
index d7868a650a..a33573a1d1 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
@@ -13,7 +13,7 @@
 	} from '$lib/gen'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { base } from '$lib/base'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 
 	import { Button, Url } from '$lib/components/common'
@@ -28,23 +28,17 @@
 		useOperatingWorkspace
 	} from '$lib/components/operatingWorkspace.svelte'
 
-	// Declared before `DEFAULT_PUSH_CONFIG` / the `base_endpoint` prop default,
-	// which call `getBaseUrl()` (a `wsId` reader) during component init.
 	const operatingWorkspace = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
 	const actingUser = $derived(operatingUser.current)
 	const wsId = $derived($operatingWorkspace)
+	const base_endpoint = $derived(`${apiBaseUrl()}/api/gcp/w/${wsId!}`)
 
 	let topic_items: string[] = $state([])
 	let subscription_items: string[] = $state([])
 	let loadingTopic = $state(false)
 	let loadingSubscription = $state(false)
 
-	const DEFAULT_PUSH_CONFIG: PushConfig = {
-		audience: getBaseUrl(),
-		authenticate: false
-	}
-
 	async function loadAllPubSubTopicsFromProject() {
 		// Listing is admin-only under application default credentials, and a non-admin viewing an
 		// inherited trigger cannot change the topic anyway, so asking would only raise a 403 toast.
@@ -117,7 +111,6 @@
 		delivery_type?: DeliveryType | undefined
 		delivery_config: PushConfig | undefined
 		subscription_mode?: SubscriptionMode
-		base_endpoint?: string
 		path?: string
 		showTestingBadge?: boolean
 		cloud_subscription_id?: string
@@ -139,7 +132,6 @@
 		delivery_type = $bindable('pull'),
 		delivery_config = $bindable(),
 		subscription_mode = $bindable('create_update'),
-		base_endpoint = $bindable(getBaseUrl()),
 		auto_acknowledge_msg = $bindable(true),
 		ack_deadline = $bindable(),
 		path = '',
@@ -199,17 +191,9 @@
 		if (!delivery_type) {
 			delivery_type = 'pull'
 		} else if (delivery_type === 'push' && !delivery_config) {
-			delivery_config = DEFAULT_PUSH_CONFIG
+			delivery_config = { audience: base_endpoint, authenticate: false }
 		}
 	})
-	function getBaseUrl() {
-		return `${window.location.origin}${base}/api/gcp/w/${wsId!}`
-	}
-
-	$effect(() => {
-		!base_endpoint && (base_endpoint = getBaseUrl())
-	})
-
 	$effect(() => {
 		if (emptyStringTrimmed(subscription_id) && !emptyStringTrimmed(path)) {
 			subscription_id = `windmill-${wsId!}-${path.replaceAll('/', '_')}`
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
index 481395a138..49ba66448c 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
@@ -36,6 +36,7 @@
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
 	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import { base } from '$lib/base'
 	import Tabs from '$lib/components/common/tabs/Tabs.svelte'
 	import Tab from '$lib/components/common/tabs/Tab.svelte'
@@ -88,7 +89,7 @@
 	let permissionedAs = $state<string | undefined>(undefined)
 	let selectedPermissionedAs = $state<string | undefined>(undefined)
 	let preservePermissionedAs = $state(false)
-	let base_endpoint = $derived(`${window.location.origin}${base}`)
+	let base_endpoint = $derived(apiBaseUrl())
 	let auto_acknowledge_msg = $state(true)
 	let ack_deadline: number | undefined = $state()
 	let optionTabSelected: 'settings' | 'error_handler' | 'retries' = $state('error_handler')
@@ -163,12 +164,17 @@
 	)
 	const captureConfig = $derived.by(untrack(() => isEditor) ? getGcpCaptureConfig : () => ({}))
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultValues?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
 		drawerLoading = true
@@ -201,8 +207,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		defaultValues?: Record<string, any>
+		defaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		drawerLoading = true
 		try {
 			drawer?.openDrawer()
@@ -244,6 +256,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			drawerLoading = false
 		}
@@ -307,6 +320,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getGcpConfig()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = gcpConfig
@@ -359,7 +377,9 @@
 			subscription_id,
 			delivery_type,
 			delivery_config,
-			base_endpoint,
+			// The capture URL shown to the user stays on the browsing origin, so the
+			// endpoint registered for it must too.
+			base_endpoint: `${window.location.origin}${base}`,
 			auto_acknowledge_msg,
 			ack_deadline,
 			topic_id,
@@ -441,7 +461,9 @@
 			? can_write
 				? `Edit GCP Pub/Sub trigger ${initialPath}`
 				: `GCP Pub/Sub trigger ${initialPath}`
-			: 'New GCP Pub/Sub trigger'}
+			: saveDraftHandler
+				? 'Draft GCP Pub/Sub trigger'
+				: 'New GCP Pub/Sub trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -498,6 +520,7 @@
 			{allowDraft}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			onToggleMode={handleToggleMode}
diff --git a/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte b/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
index b0cc491393..024086552c 100644
--- a/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
+++ b/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
@@ -15,7 +15,7 @@
 	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { base } from '$lib/base'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import Label from '$lib/components/Label.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { ClipboardCopy, Download, Trash } from 'lucide-svelte'
@@ -136,7 +136,7 @@
 			obj = {
 				openapi_spec_format: lang,
 				info,
-				url: `${window.location.origin}${base}`,
+				url: apiBaseUrl(),
 				http_route_filters: getHttpRouteFilters(),
 				webhook_filters: getWebhookFilters()
 			}
@@ -155,7 +155,7 @@
 				requestBody: {
 					openapi_spec_format,
 					info,
-					url: `${window.location.origin}${base}`,
+					url: apiBaseUrl(),
 					http_route_filters: getHttpRouteFilters(),
 					webhook_filters: getWebhookFilters()
 				}
@@ -225,7 +225,7 @@
 				{/snippet}
 				<CopyableCodeBlock
 					code={`token=${emptyString(token) ? '' : token}; \\
-curl -X POST "${window.location.origin}${base}/api/w/${$operatingWorkspace!}/openapi/generate" \\
+curl -X POST "${apiBaseUrl()}/api/w/${$operatingWorkspace!}/openapi/generate" \\
 -H "Authorization: Bearer $token" \\
 -H "Content-Type: application/json" \\
 -d '${JSON.stringify(obj)}'`}
diff --git a/frontend/src/lib/components/triggers/http/utils.ts b/frontend/src/lib/components/triggers/http/utils.ts
index ed03ef86aa..cc4d366be4 100644
--- a/frontend/src/lib/components/triggers/http/utils.ts
+++ b/frontend/src/lib/components/triggers/http/utils.ts
@@ -1,4 +1,4 @@
-import { base } from '$lib/base'
+import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 import { isCloudHosted } from '$lib/cloud'
 import { random_adj } from '$lib/components/random_positive_adjetive'
 import type { HttpMethod, NewHttpTrigger } from '$lib/gen'
@@ -33,8 +33,7 @@ export function allowedOriginRejection(origin: string): string | undefined {
 	if (origin === '') return 'An origin must not be empty'
 	if (origin.length > MAX_ALLOWED_ORIGIN_LEN)
 		return `'${origin.slice(0, 40)}…' is longer than any origin a browser sends`
-	if (origin.includes(','))
-		return `'${origin}' must not contain a comma, which separates entries`
+	if (origin.includes(',')) return `'${origin}' must not contain a comma, which separates entries`
 	if (origin.toLowerCase() === 'null')
 		return `'null' is what a sandboxed iframe sends, so it would allow any page that can open one`
 	if (!/^[\x21-\x7e]+$/.test(origin))
@@ -85,8 +84,7 @@ export function allowedOriginWarning(origin: string): string | undefined {
 	if (rest.startsWith(':')) return `'${origin}' has no host`
 	// An unclosed bracket would otherwise leave `portStart` at zero, which reads
 	// as "no port" and lets the entry through unremarked.
-	if (rest.startsWith('[') && !rest.includes(']'))
-		return `'${origin}' has an unclosed IPv6 host`
+	if (rest.startsWith('[') && !rest.includes(']')) return `'${origin}' has an unclosed IPv6 host`
 	const portStart = rest.startsWith('[') ? rest.indexOf(']') + 1 : rest.indexOf(':')
 	// A trailing colon is a port, an empty one — distinct from having none.
 	const port = portStart > 0 && rest[portStart] === ':' ? rest.slice(portStart + 1) : undefined
@@ -160,7 +158,7 @@ export function getHttpRoute(
 	workspaced_route: boolean,
 	workspace_id: string
 ) {
-	return `${location.origin}${base}/api/${route_prefix}/${
+	return `${apiBaseUrl()}/api/${route_prefix}/${
 		isCloudHosted() || workspaced_route ? workspace_id + '/' : ''
 	}${route_path ?? ''}`
 }
diff --git a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditor.svelte b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditor.svelte
index 73d32c0d52..0769c8ed0e 100644
--- a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: KafkaTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
index 3136f74c47..b4ab6c274f 100644
--- a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
@@ -174,12 +174,17 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
@@ -217,8 +222,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		nDefaultValues?: Record<string, any>
+		nDefaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -252,6 +263,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			clearTimeout(loadingTimeout)
 			drawerLoading = false
@@ -334,6 +346,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = getSaveCfg()
@@ -453,7 +470,9 @@
 			? can_write
 				? `Edit Kafka trigger ${initialPath}`
 				: `Kafka trigger ${initialPath}`
-			: 'New Kafka trigger'}
+			: saveDraftHandler
+				? 'Draft Kafka trigger'
+				: 'New Kafka trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -511,6 +530,7 @@
 			{isDeployed}
 			{saveDisabled}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			onToggleMode={handleToggleMode}
diff --git a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditor.svelte b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditor.svelte
index fea56a3750..c8300ee81e 100644
--- a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: MqttTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
index d21fb1ff44..8a745b692a 100644
--- a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
@@ -169,12 +169,17 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
@@ -212,8 +217,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		defaultValues?: Record<string, any>
+		defaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100)
@@ -248,6 +259,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			clearTimeout(loadingTimeout)
 			drawerLoading = false
@@ -347,6 +359,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = getSaveCfg()
@@ -427,7 +444,9 @@
 			? can_write
 				? `Edit MQTT trigger ${initialPath}`
 				: `MQTT trigger ${initialPath}`
-			: 'New MQTT trigger'}
+			: saveDraftHandler
+				? 'Draft MQTT trigger'
+				: 'New MQTT trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -485,6 +504,7 @@
 			isLoading={deploymentLoading}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			onToggleMode={handleToggleMode}
diff --git a/frontend/src/lib/components/triggers/nats/NatsTriggerEditor.svelte b/frontend/src/lib/components/triggers/nats/NatsTriggerEditor.svelte
index aa5585a7b6..add8b43d75 100644
--- a/frontend/src/lib/components/triggers/nats/NatsTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/nats/NatsTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: NatsTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
index 3fe3fbbc8a..1869aa2af6 100644
--- a/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
@@ -157,12 +157,17 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
@@ -206,8 +211,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		nDefaultValues?: Record<string, any>
+		nDefaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100)
@@ -241,6 +252,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			clearTimeout(loadingTimeout)
 			drawerLoading = false
@@ -326,6 +338,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = natsConfig
@@ -424,7 +441,9 @@
 			? can_write
 				? `Edit NATS trigger ${initialPath}`
 				: `NATS trigger ${initialPath}`
-			: 'New NATS trigger'}
+			: saveDraftHandler
+				? 'Draft NATS trigger'
+				: 'New NATS trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -481,6 +500,7 @@
 			isLoading={deploymentLoading}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			{cloudDisabled}
diff --git a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditor.svelte b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditor.svelte
index 66702a54ab..c9ec98881c 100644
--- a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, undefined, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: PostgresTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
index 9025ed57a0..b8dd60c6f9 100644
--- a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
@@ -258,12 +258,17 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
@@ -307,8 +312,14 @@
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
 		defaultValues?: Record<string, any>,
-		newDraft?: boolean
+		newDraft?: boolean,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -352,6 +363,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			clearTimeout(loadingTimeout)
 			drawerLoading = false
@@ -477,6 +489,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		const cfg = postgresConfig
 		if (!cfg) {
 			return
@@ -608,7 +625,9 @@
 			? can_write
 				? `Edit Postgres trigger ${initialPath}`
 				: `Postgres trigger ${initialPath}`
-			: 'New Postgres trigger'}
+			: saveDraftHandler
+				? 'Draft Postgres trigger'
+				: 'New Postgres trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}{@render actionsSnippet()}{/snippet}
@@ -663,6 +682,7 @@
 			isLoading={deploymentLoading}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			{mode}
diff --git a/frontend/src/lib/components/triggers/schedules/ScheduleAdvancedOptions.svelte b/frontend/src/lib/components/triggers/schedules/ScheduleAdvancedOptions.svelte
new file mode 100644
index 0000000000..1b785b293e
--- /dev/null
+++ b/frontend/src/lib/components/triggers/schedules/ScheduleAdvancedOptions.svelte
@@ -0,0 +1,670 @@
+<script lang="ts" module>
+	import { handlerFullPath } from '$lib/components/ErrorOrRecoveryHandler.svelte'
+	import { SettingService, type ErrorHandler, type Retry } from '$lib/gen'
+
+	export type ScheduleAdvancedState = {
+		errorHandlerSelected: ErrorHandler
+		errorHandlerPath: string | undefined
+		errorHandleritemKind: 'flow' | 'script'
+		errorHandlerExtraArgs: Record<string, any>
+		wsErrorHandlerMuted: boolean
+		failedTimes: number
+		failedExact: boolean
+		recoveryHandlerSelected: ErrorHandler
+		recoveryHandlerPath: string | undefined
+		recoveryHandlerItemKind: 'flow' | 'script'
+		recoveryHandlerExtraArgs: Record<string, any>
+		recoveredTimes: number
+		successHandlerSelected: ErrorHandler
+		successHandlerPath: string | undefined
+		successHandlerItemKind: 'flow' | 'script'
+		successHandlerExtraArgs: Record<string, any>
+		retry: Retry | undefined
+		dynamicSkipPath: string | undefined
+		tag: string | undefined
+	}
+
+	export function emptyScheduleAdvanced(): ScheduleAdvancedState {
+		return {
+			errorHandlerSelected: 'slack',
+			errorHandlerPath: undefined,
+			errorHandleritemKind: 'script',
+			errorHandlerExtraArgs: {},
+			wsErrorHandlerMuted: false,
+			failedTimes: 1,
+			failedExact: false,
+			recoveryHandlerSelected: 'slack',
+			recoveryHandlerPath: undefined,
+			recoveryHandlerItemKind: 'script',
+			recoveryHandlerExtraArgs: {},
+			recoveredTimes: 1,
+			successHandlerSelected: 'slack',
+			successHandlerPath: undefined,
+			successHandlerItemKind: 'script',
+			successHandlerExtraArgs: {},
+			retry: undefined,
+			dynamicSkipPath: undefined,
+			tag: undefined
+		}
+	}
+
+	/** Which built-in handler a hub path is, or `custom`. */
+	export function getHandlerType(
+		isHandler: 'error' | 'recovery' | 'success',
+		scriptPath: string
+	): ErrorHandler {
+		const handlerMap = {
+			error: {
+				teams: '/workspace-or-schedule-error-handler-teams',
+				slack: '/workspace-or-schedule-error-handler-slack',
+				email: '/workspace-or-error-handler-email'
+			},
+			recovery: {
+				teams: '/schedule-recovery-handler-teams',
+				slack: '/schedule-recovery-handler-slack',
+				email: '/workspace-or-error-handler-email'
+			},
+			success: {
+				teams: '/schedule-success-handler-teams',
+				slack: '/schedule-success-handler-slack',
+				email: '/workspace-or-error-handler-email'
+			}
+		}
+
+		for (const [type, suffix] of Object.entries(handlerMap[isHandler])) {
+			if (scriptPath.startsWith('hub/') && scriptPath.endsWith(suffix)) {
+				return type as ErrorHandler
+			}
+		}
+		return 'custom'
+	}
+
+	const splitHandler = (path: string) => {
+		const [kind, ...rest] = path.split('/')
+		return { kind: kind as 'flow' | 'script', path: rest.join('/') }
+	}
+
+	/** The Advanced tabs of a new schedule: the workspace's default error, recovery
+	 * and success handlers, where it sets them. */
+	export async function loadDefaultScheduleAdvanced(wsId: string): Promise<ScheduleAdvancedState> {
+		const a = emptyScheduleAdvanced()
+		const [err, rec, suc] = (await Promise.all(
+			['error', 'recovery', 'success'].map((k) =>
+				SettingService.getGlobal({ key: `default_${k}_handler_${wsId}` })
+			)
+		)) as any[]
+		if (err) {
+			const h = splitHandler(err.errorHandlerPath)
+			a.wsErrorHandlerMuted = err.wsErrorHandlerMuted
+			a.errorHandleritemKind = h.kind
+			a.errorHandlerPath = h.path
+			a.errorHandlerExtraArgs = err.errorHandlerExtraArgs
+			a.errorHandlerSelected = getHandlerType('error', h.path)
+			a.failedTimes = err.failedTimes
+			a.failedExact = err.failedExact
+		}
+		if (rec) {
+			const h = splitHandler(rec.recoveryHandlerPath)
+			a.recoveryHandlerItemKind = h.kind
+			a.recoveryHandlerPath = h.path
+			a.recoveryHandlerExtraArgs = rec.recoveryHandlerExtraArgs
+			a.recoveryHandlerSelected = getHandlerType('recovery', h.path)
+			a.recoveredTimes = rec.recoveredTimes
+		}
+		if (suc) {
+			const h = splitHandler(suc.successHandlerPath)
+			a.successHandlerItemKind = h.kind
+			a.successHandlerPath = h.path
+			a.successHandlerExtraArgs = suc.successHandlerExtraArgs
+			a.successHandlerSelected = getHandlerType('success', h.path)
+		}
+		return a
+	}
+
+	/** The schedule fields the Advanced tabs own, as the schedule API takes them. */
+	export function scheduleAdvancedCfg(a: ScheduleAdvancedState) {
+		return {
+			on_failure: a.errorHandlerPath
+				? handlerFullPath(a.errorHandlerSelected, a.errorHandleritemKind, a.errorHandlerPath)
+				: undefined,
+			on_failure_times: a.failedTimes,
+			on_failure_exact: a.failedExact,
+			on_failure_extra_args: a.errorHandlerPath ? a.errorHandlerExtraArgs : undefined,
+			on_recovery: a.recoveryHandlerPath
+				? handlerFullPath(
+						a.recoveryHandlerSelected,
+						a.recoveryHandlerItemKind,
+						a.recoveryHandlerPath
+					)
+				: undefined,
+			on_recovery_times: a.recoveredTimes,
+			on_recovery_extra_args: a.recoveryHandlerPath ? a.recoveryHandlerExtraArgs : {},
+			on_success: a.successHandlerPath
+				? handlerFullPath(a.successHandlerSelected, a.successHandlerItemKind, a.successHandlerPath)
+				: undefined,
+			on_success_extra_args: a.successHandlerPath ? a.successHandlerExtraArgs : {},
+			ws_error_handler_muted: a.wsErrorHandlerMuted,
+			retry: a.retry,
+			tag: a.tag,
+			dynamic_skip: a.dynamicSkipPath
+		}
+	}
+</script>
+
+<script lang="ts">
+	import { Alert, Button, Tab, Tabs } from '$lib/components/common'
+	import ErrorOrRecoveryHandler from '$lib/components/ErrorOrRecoveryHandler.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import Tooltip from '$lib/components/Tooltip.svelte'
+	import Dropdown from '$lib/components/DropdownV2.svelte'
+	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
+	import Section from '$lib/components/Section.svelte'
+	import Label from '$lib/components/Label.svelte'
+	import WorkerTagPicker from '$lib/components/WorkerTagPicker.svelte'
+	import FlowRetries from '$lib/components/flows/content/FlowRetries.svelte'
+	import { ScheduleService } from '$lib/gen'
+	import { enterpriseLicense } from '$lib/stores'
+	import { emptyString, sendUserToast } from '$lib/utils'
+	import { Loader2, Save } from 'lucide-svelte'
+
+	// The schedule drawer's Advanced tabs, shared with editors that configure a
+	// schedule before it exists (the pipeline editor's create wizard).
+	interface Props {
+		wsId: string | undefined
+		itemKind: 'flow' | 'script'
+		canWrite: boolean
+		loading?: boolean
+		errorHandlerSelected: ErrorHandler
+		errorHandlerPath: string | undefined
+		errorHandleritemKind: 'flow' | 'script'
+		errorHandlerExtraArgs: Record<string, any>
+		wsErrorHandlerMuted: boolean
+		failedTimes: number
+		failedExact: boolean
+		recoveryHandlerSelected: ErrorHandler
+		recoveryHandlerPath: string | undefined
+		recoveryHandlerItemKind: 'flow' | 'script'
+		recoveryHandlerExtraArgs: Record<string, any>
+		recoveredTimes: number
+		successHandlerSelected: ErrorHandler
+		successHandlerPath: string | undefined
+		successHandlerItemKind: 'flow' | 'script'
+		successHandlerExtraArgs: Record<string, any>
+		retry: Retry | undefined
+		dynamicSkipPath: string | undefined
+		tag: string | undefined
+	}
+
+	let {
+		wsId,
+		itemKind,
+		canWrite,
+		loading = false,
+		errorHandlerSelected = $bindable(),
+		errorHandlerPath = $bindable(),
+		errorHandleritemKind = $bindable(),
+		errorHandlerExtraArgs = $bindable(),
+		wsErrorHandlerMuted = $bindable(),
+		failedTimes = $bindable(),
+		failedExact = $bindable(),
+		recoveryHandlerSelected = $bindable(),
+		recoveryHandlerPath = $bindable(),
+		recoveryHandlerItemKind = $bindable(),
+		recoveryHandlerExtraArgs = $bindable(),
+		recoveredTimes = $bindable(),
+		successHandlerSelected = $bindable(),
+		successHandlerPath = $bindable(),
+		successHandlerItemKind = $bindable(),
+		successHandlerExtraArgs = $bindable(),
+		retry = $bindable(),
+		dynamicSkipPath = $bindable(),
+		tag = $bindable()
+	}: Props = $props()
+
+	let optionTabSelected:
+		| 'error_handler'
+		| 'recovery_handler'
+		| 'success_handler'
+		| 'retries'
+		| 'dynamic_skip'
+		| 'tag' = $state('error_handler')
+
+	// Carry the acting workspace onto "create from template" routes, so the script is created
+	// in the workspace this schedule lives in.
+	const wsParam = $derived(wsId ? `&workspace=${encodeURIComponent(wsId)}` : '')
+
+	async function saveAsDefaultErrorHandler(overrideExisting: boolean) {
+		if (!$enterpriseLicense) {
+			sendUserToast(`Setting default error handler is an enterprise edition feature`, true)
+			return
+		}
+		if (wsId) {
+			await ScheduleService.setDefaultErrorOrRecoveryHandler({
+				workspace: wsId!,
+				requestBody: {
+					handler_type: 'error',
+					override_existing: overrideExisting,
+					path:
+						errorHandlerPath == undefined
+							? undefined
+							: handlerFullPath(errorHandlerSelected, errorHandleritemKind, errorHandlerPath),
+					extra_args: errorHandlerExtraArgs,
+					number_of_occurence: failedTimes,
+					number_of_occurence_exact: failedExact,
+					workspace_handler_muted: wsErrorHandlerMuted
+				}
+			})
+			if (errorHandlerPath !== undefined) {
+				sendUserToast(`Default error handler saved to ${errorHandlerPath}`, false)
+			} else {
+				sendUserToast(`Default error handler reset`, false)
+			}
+		}
+	}
+
+	async function saveAsDefaultRecoveryHandler(overrideExisting: boolean) {
+		if (!$enterpriseLicense) {
+			sendUserToast(`Setting default recovery handler is an enterprise edition feature`, true)
+			return
+		}
+		if (wsId) {
+			await ScheduleService.setDefaultErrorOrRecoveryHandler({
+				workspace: wsId!,
+				requestBody: {
+					handler_type: 'recovery',
+					override_existing: overrideExisting,
+					path:
+						recoveryHandlerPath === undefined
+							? undefined
+							: handlerFullPath(
+									recoveryHandlerSelected,
+									recoveryHandlerItemKind,
+									recoveryHandlerPath
+								),
+					extra_args: recoveryHandlerExtraArgs,
+					number_of_occurence: recoveredTimes
+				}
+			})
+			if (recoveryHandlerPath !== undefined) {
+				sendUserToast(`Default recovery handler saved to ${recoveryHandlerPath}`, false)
+			} else {
+				sendUserToast(`Default recovery handler reset`, false)
+			}
+		}
+	}
+
+	async function saveAsDefaultSuccessHandler(overrideExisting: boolean) {
+		if (!$enterpriseLicense) {
+			sendUserToast(`Setting default success handler is an enterprise edition feature`, true)
+			return
+		}
+		if (wsId) {
+			await ScheduleService.setDefaultErrorOrRecoveryHandler({
+				workspace: wsId!,
+				requestBody: {
+					handler_type: 'success',
+					override_existing: overrideExisting,
+					path:
+						successHandlerPath === undefined
+							? undefined
+							: handlerFullPath(successHandlerSelected, successHandlerItemKind, successHandlerPath),
+					extra_args: successHandlerExtraArgs,
+					number_of_occurence: recoveredTimes
+				}
+			})
+			if (successHandlerPath !== undefined) {
+				sendUserToast(`Default success handler saved to ${successHandlerPath}`, false)
+			} else {
+				sendUserToast(`Default success handler reset`, false)
+			}
+		}
+	}
+</script>
+
+<div class="flex flex-col gap-2 min-h-96">
+	{#if !loading}
+		<Tabs bind:selected={optionTabSelected}>
+			<Tab value="error_handler" label="Error Handler" />
+			<Tab value="recovery_handler" label="Recovery Handler" />
+			<Tab value="success_handler" label="Success Handler" />
+			<Tab value="retries" label="Retries" />
+			<Tab value="dynamic_skip" label="Dynamic skip" />
+			{#if itemKind === 'script'}
+				<Tab value="tag" label="Custom tag" />
+			{/if}
+		</Tabs>
+		{#if optionTabSelected === 'error_handler'}
+			<Section label="Error handler">
+				{#snippet header()}
+					<div class="flex flex-row gap-2">
+						{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
+					</div>
+				{/snippet}
+				{#snippet action()}
+					<div class="flex flex-row items-center gap-1 text-xs text-secondary">
+						<Dropdown
+							disabled={!canWrite}
+							items={[
+								{
+									displayName: `Override future schedules only`,
+									action: () => saveAsDefaultErrorHandler(false)
+								},
+								{
+									displayName: 'Override all existing',
+									type: 'delete',
+									action: () => saveAsDefaultErrorHandler(true)
+								}
+							]}
+						>
+							{#snippet buttonReplacement()}
+								<Save size={12} class="mr-1" />
+								Set as default
+							{/snippet}
+						</Dropdown>
+					</div>
+				{/snippet}
+				<div class="flex flex-row py-2">
+					<Toggle
+						size="xs"
+						disabled={!canWrite || !$enterpriseLicense}
+						bind:checked={wsErrorHandlerMuted}
+						options={{ right: 'Mute workspace error handler for this schedule' }}
+					/>
+				</div>
+
+				<ErrorOrRecoveryHandler
+					workspace={wsId}
+					isEditable={canWrite}
+					errorOrRecovery="error"
+					showScriptHelpText={true}
+					bind:handlerSelected={errorHandlerSelected}
+					bind:handlerPath={errorHandlerPath}
+					toggleText="Alert channel on error"
+					customScriptTemplate="/scripts/add?hub=hub%2F19743%2Fwindmill%2Fschedule_error_handler_template"
+					bind:customHandlerKind={errorHandleritemKind}
+					bind:handlerExtraArgs={errorHandlerExtraArgs}
+				>
+					{#snippet customTabTooltip()}
+						<Tooltip>
+							<div class="flex gap-20 items-start mt-3">
+								<div class="text-xs"
+									>The following args will be passed to the error handler:
+									<ul class="mt-1 ml-2">
+										<li
+											><b>workspace_id</b>: The ID of the workspace that the schedule belongs to.</li
+										>
+										<li><b>job_id</b>: The UUID of the job that errored.</li>
+										<li><b>path</b>: The path of the script or flow that failed.</li>
+										<li><b>is_flow</b>: Whether the runnable is a flow.</li>
+										<li><b>schedule_path</b>: The path of the schedule.</li>
+										<li><b>error</b>: The error details.</li>
+										<li
+											><b>failed_times</b>: Minimum number of times the schedule failed before
+											calling the error handler.</li
+										>
+										<li><b>started_at</b>: The start datetime of the latest job that failed.</li>
+									</ul>
+								</div>
+							</div>
+						</Tooltip>
+					{/snippet}
+				</ErrorOrRecoveryHandler>
+				<div class="flex flex-row items-center justify-between">
+					<div class="flex flex-row items-center mt-4 font-semibold text-xs gap-2">
+						<p class={emptyString(errorHandlerPath) ? 'text-primary' : ''}>
+							Triggered when schedule failed</p
+						>
+						<select
+							class="!w-14"
+							bind:value={failedExact}
+							disabled={!canWrite || !$enterpriseLicense || emptyString(errorHandlerPath)}
+						>
+							<option value={false}>&gt;=</option>
+							<option value={true}>==</option>
+						</select>
+						<input
+							type="number"
+							class="!w-14 text-center {emptyString(errorHandlerPath) ? 'text-primary' : ''}"
+							bind:value={failedTimes}
+							disabled={!canWrite || !$enterpriseLicense}
+							min="1"
+						/>
+						<p class={emptyString(errorHandlerPath) ? 'text-primary' : ''}
+							>time{failedTimes > 1 ? 's in a row' : ''}</p
+						>
+					</div>
+				</div>
+			</Section>
+		{:else if optionTabSelected === 'recovery_handler'}
+			{@const disabled = !canWrite || emptyString($enterpriseLicense)}
+			<Section label="Recovery handler">
+				{#snippet header()}
+					<div class="flex flex-row gap-2">
+						{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
+					</div>
+				{/snippet}
+				{#snippet action()}
+					<div class="flex flex-row items-center text-secondary text-xs gap-2">
+						defaults
+						<Dropdown
+							{disabled}
+							items={[
+								{
+									displayName: `Override future schedules only`,
+									action: () => saveAsDefaultRecoveryHandler(false)
+								},
+								{
+									displayName: 'Override all existing',
+									type: 'delete',
+									action: () => saveAsDefaultRecoveryHandler(true)
+								}
+							]}
+						>
+							{#snippet buttonReplacement()}
+								<Save size={12} class="mr-1" />
+								Set as default
+							{/snippet}
+						</Dropdown>
+					</div>
+				{/snippet}
+				<ErrorOrRecoveryHandler
+					workspace={wsId}
+					isEditable={!disabled}
+					errorOrRecovery="recovery"
+					bind:handlerSelected={recoveryHandlerSelected}
+					bind:handlerPath={recoveryHandlerPath}
+					toggleText="Alert channel when error recovered"
+					customScriptTemplate="/scripts/add?hub=hub%2F9082%2Fwindmill%2Fschedule_recovery_handler_template"
+					bind:customHandlerKind={recoveryHandlerItemKind}
+					bind:handlerExtraArgs={recoveryHandlerExtraArgs}
+				>
+					{#snippet customTabTooltip()}
+						<Tooltip>
+							<div class="flex gap-20 items-start mt-3">
+								<div class="text-xs"
+									>The following args will be passed to the recovery handler:
+									<ul class="mt-1 ml-2">
+										<li><b>path</b>: The path of the script or flow that recovered.</li>
+										<li><b>is_flow</b>: Whether the runnable is a flow.</li>
+										<li><b>schedule_path</b>: The path of the schedule.</li>
+										<li><b>error</b>: The error of the last job that errored</li>
+										<li><b>error_started_at</b>: The start datetime of the last job that errored</li
+										>
+										<li
+											><b>success_times</b>: The number of times the schedule succeeded before
+											calling the recovery handler.</li
+										>
+										<li><b>success_result</b>: The result of the latest successful job</li>
+										<li
+											><b>success_started_at</b>: The start datetime of the latest successful job</li
+										>
+									</ul>
+								</div>
+							</div>
+						</Tooltip>
+					{/snippet}
+				</ErrorOrRecoveryHandler>
+				<div class="flex flex-row items-center justify-between">
+					<div
+						class="flex flex-row items-center mt-5 font-semibold text-xs {emptyString(
+							recoveryHandlerPath
+						)
+							? 'text-primary'
+							: ''}"
+					>
+						<p>Triggered when schedule recovered</p>
+						<input
+							type="number"
+							class="!w-14 mx-2 text-center"
+							bind:value={recoveredTimes}
+							min="1"
+							{disabled}
+						/>
+						<p>time{recoveredTimes > 1 ? 's in a row' : ''}</p>
+					</div>
+				</div>
+			</Section>
+		{:else if optionTabSelected === 'success_handler'}
+			{@const disabled = !canWrite || emptyString($enterpriseLicense)}
+			<Section label="Success handler">
+				{#snippet header()}
+					<div class="flex flex-row gap-2">
+						{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
+					</div>
+				{/snippet}
+				{#snippet action()}
+					<div class="flex flex-row items-center text-secondary text-xs gap-2">
+						defaults
+						<Dropdown
+							{disabled}
+							items={[
+								{
+									displayName: `Override future schedules only`,
+									action: () => saveAsDefaultSuccessHandler(false)
+								},
+								{
+									displayName: 'Override all existing',
+									type: 'delete',
+									action: () => saveAsDefaultSuccessHandler(true)
+								}
+							]}
+						>
+							{#snippet buttonReplacement()}
+								<Save size={12} class="mr-1" />
+								Set as default
+							{/snippet}
+						</Dropdown>
+					</div>
+				{/snippet}
+				<ErrorOrRecoveryHandler
+					workspace={wsId}
+					isEditable={!disabled}
+					errorOrRecovery="success"
+					bind:handlerSelected={successHandlerSelected}
+					bind:handlerPath={successHandlerPath}
+					toggleText="Alert channel when successful"
+					customScriptTemplate="/scripts/add?hub=hub%2F9071%2Fwindmill%2Fschedule_success_handler_template"
+					bind:customHandlerKind={successHandlerItemKind}
+					bind:handlerExtraArgs={successHandlerExtraArgs}
+				>
+					{#snippet customTabTooltip()}
+						<Tooltip>
+							<div class="flex gap-20 items-start mt-3">
+								<div class="text-xs"
+									>The following args will be passed to the success handler:
+									<ul class="mt-1 ml-2">
+										<li><b>path</b>: The path of the script or flow that succeeded.</li>
+										<li><b>is_flow</b>: Whether the runnable is a flow.</li>
+										<li><b>schedule_path</b>: The path of the schedule.</li>
+										<li><b>success_result</b>: The result of the successful job</li>
+										<li><b>success_started_at</b>: The start datetime of the successful job</li>
+									</ul>
+								</div>
+							</div>
+						</Tooltip>
+					{/snippet}
+				</ErrorOrRecoveryHandler>
+			</Section>
+		{:else if optionTabSelected === 'retries'}
+			{@const disabled = !canWrite || emptyString($enterpriseLicense)}
+			<Section label="Retries">
+				{#snippet header()}
+					<div class="flex flex-row gap-2">
+						{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
+					</div>
+					<Tooltip>
+						If defined, upon error this schedule will be retried with a delay and a maximum number
+						of attempts as defined below.
+						<br />
+						This is only available for individual script. For flows, retries can be set on each flow
+						step in the flow editor.
+					</Tooltip>
+				{/snippet}
+				{#if itemKind !== 'script'}
+					<Alert type="info" title="Only available for scripts" class="mb-2">
+						Error Handler and Retries are only available for scripts. For flows, use the built-in <a
+							href="https://www.windmill.dev/docs/flows/flow_error_handler"
+							target="_blank">error handler</a
+						>
+						and <a href="https://www.windmill.dev/docs/flows/retries" target="_blank">retries</a>.
+					</Alert>
+				{:else}
+					<FlowRetries bind:flowModuleRetry={retry} disabled={itemKind !== 'script' || disabled} />
+				{/if}
+			</Section>
+		{:else if optionTabSelected === 'dynamic_skip'}
+			<Section label="Dynamic skip">
+				{#snippet header()}
+					<Tooltip>
+						Optional script to filter scheduled dates. Receives the proposed datetime and returns
+						boolean. True = run on this date, False = skip to next occurrence.
+					</Tooltip>
+				{/snippet}
+				<div class="flex flex-col gap-6">
+					<Label label="Dynamic skip script">
+						<div class="flex flex-row">
+							<ScriptPicker
+								workspace={wsId}
+								disabled={!canWrite}
+								bind:scriptPath={dynamicSkipPath}
+								kinds={['script']}
+								allowRefresh={canWrite}
+								clearable
+							/>
+							{#if !dynamicSkipPath}
+								<Button
+									btnClasses="ml-4 whitespace-nowrap"
+									variant="default"
+									size="xs"
+									href="/scripts/add?hub=hub%2F19822%2Fwindmill%2Fdynamic_skip_template{wsParam}"
+									disabled={!canWrite}
+									target="_blank"
+								>
+									Create from template
+								</Button>
+							{/if}
+						</div>
+					</Label>
+					<Alert type="info" size="xs" title="Handler requirements">
+						Handler must return a boolean value. Return true to execute the scheduled job, false to
+						skip.
+					</Alert>
+				</div>
+			</Section>
+		{:else if optionTabSelected === 'tag'}
+			<Section
+				label="Custom script tag"
+				tooltip="When set, the script tag will be overridden by this tag"
+			>
+				<WorkerTagPicker
+					bind:tag
+					workspaceId={wsId}
+					popupPlacement="top-end"
+					disabled={!canWrite}
+				/>
+			</Section>
+		{/if}
+	{:else}
+		<Loader2 class="animate-spin" />
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/triggers/schedules/ScheduleEditor.svelte b/frontend/src/lib/components/triggers/schedules/ScheduleEditor.svelte
index 78e569d3f3..295498f428 100644
--- a/frontend/src/lib/components/triggers/schedules/ScheduleEditor.svelte
+++ b/frontend/src/lib/components/triggers/schedules/ScheduleEditor.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { tickPainted } from '$lib/utils/paint'
 	import type ScheduleEditorInner from './ScheduleEditorInner.svelte'
+	import type { Schedule } from '$lib/gen'
 
 	let { onUpdate }: { onUpdate?: (path?: string) => void } = $props()
 
@@ -29,6 +30,17 @@
 		drawer?.openNew(is_flow, initial_script_path, undefined, schedule_path, fixedScriptPath)
 	}
 
+	/** Edit a schedule that exists only as the caller's draft; Save hands it back. */
+	export async function openDraft(
+		cfg: Schedule,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await loadInner()
+		await tickPainted()
+		drawer?.openNew(false, cfg.script_path, cfg, undefined, cfg.script_path, { onSaveDraft })
+	}
+
 	let drawer: ScheduleEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte b/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
index 1563407150..18d5611a67 100644
--- a/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
@@ -1,11 +1,17 @@
 <script lang="ts">
-	import { Alert, Badge, Button, ButtonType, Tab, Tabs } from '$lib/components/common'
+	import { Alert, Badge, Button, ButtonType } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { SCHEDULES_PATH } from '$lib/components/sessions/previewPaths'
 	import TriggerAdvancedBadges from '../TriggerAdvancedBadges.svelte'
+	import ScheduleAdvancedOptions, {
+		emptyScheduleAdvanced,
+		getHandlerType,
+		loadDefaultScheduleAdvanced,
+		scheduleAdvancedCfg
+	} from './ScheduleAdvancedOptions.svelte'
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import CronInput from '$lib/components/CronInput.svelte'
@@ -15,36 +21,27 @@
 	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
 	import { loadSchema } from '$lib/infer'
 	import PipelineLockedRunnableInfo from '$lib/components/triggers/PipelineLockedRunnableInfo.svelte'
-	import ErrorOrRecoveryHandler, {
-		handlerFullPath
-	} from '$lib/components/ErrorOrRecoveryHandler.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
 	import {
 		FlowService,
 		ScheduleService,
 		type Script,
 		ScriptService,
 		type Flow,
-		SettingService,
 		type Retry,
 		type Schedule,
 		type ErrorHandler
 	} from '$lib/gen'
-	import { enterpriseLicense } from '$lib/stores'
 	import { canWrite, emptyString, formatCron, sendUserToast, cronV1toV2 } from '$lib/utils'
 	import { useScheduleLock } from '$lib/operatorWriteRights'
 	import { base } from '$lib/base'
 	import Section from '$lib/components/Section.svelte'
-	import { List, Loader2, Save, AlertTriangle } from 'lucide-svelte'
+	import { List, Loader2, AlertTriangle } from 'lucide-svelte'
 	import autosize from '$lib/autosize'
 	import TriggerEditorToolbar from '$lib/components/triggers/TriggerEditorToolbar.svelte'
 	import { saveScheduleFromCfg } from '$lib/components/flows/scheduleUtils'
 	import DateTimeInput from '$lib/components/DateTimeInput.svelte'
-	import FlowRetries from '$lib/components/flows/content/FlowRetries.svelte'
-	import Label from '$lib/components/Label.svelte'
-	import WorkerTagPicker from '$lib/components/WorkerTagPicker.svelte'
 	import { runScheduleNow } from '../scheduled/utils'
 	import { handleConfigChange } from '../utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
@@ -74,12 +71,6 @@
 		trigger = undefined
 	} = $props()
 
-	let optionTabSelected:
-		| 'error_handler'
-		| 'recovery_handler'
-		| 'success_handler'
-		| 'retries'
-		| 'dynamic_skip' = $state('error_handler')
 	let initialPath = $state('')
 	let edit = $state(true)
 	let schedule: string = $state('0 0 12 * *')
@@ -139,6 +130,10 @@
 	let isValid = $state(true)
 	let allowSchedule = $derived(isValid && validCRON && script_path != '')
 	let deploymentLoading = $state(false)
+	// Set by `openNew({ onSaveDraft })`: the caller keeps the schedule as its own
+	// draft, so Save hands it the config instead of writing it, and nothing may
+	// autosave a workspace trigger draft for a path that is not deployed.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
 	let permissionedAs = $state<string | undefined>(undefined)
 	let selectedPermissionedAs = $state<string | undefined>(undefined)
 	let preservePermissionedAs = $state(false)
@@ -164,14 +159,11 @@
 				emptyString(errorHandlerExtraArgs['channel'])) ||
 			!can_write
 	)
-	// Carry the acting workspace onto "create from template" routes, so the script is created
-	// in the workspace this schedule lives in.
-	const wsParam = $derived(wsId ? `&workspace=${encodeURIComponent(wsId)}` : '')
 	const scheduleCfg = $derived.by(getScheduleCfg)
 
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_schedule',
-		path: () => initialPath,
+		path: () => (saveDraftHandler ? '' : initialPath),
 		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => scheduleCfg,
@@ -190,6 +182,7 @@
 		}, 100) // Do not show loading spinner for the first 100ms
 		drawerLoading = true
 		acting.forgetFailures()
+		saveDraftHandler = undefined
 		try {
 			drawer?.openDrawer()
 			setPageDrawerAnchor(SCHEDULES_PATH, ePath)
@@ -259,66 +252,23 @@
 				successHandlerExtraArgs = {}
 			}
 		} else {
-			let defaultErrorHandlerMaybe = undefined
-			let defaultRecoveryHandlerMaybe = undefined
-			let defaultSuccessHandlerMaybe = undefined
-			if (wsId) {
-				defaultErrorHandlerMaybe = (await SettingService.getGlobal({
-					key: 'default_error_handler_' + wsId!
-				})) as any
-				defaultRecoveryHandlerMaybe = (await SettingService.getGlobal({
-					key: 'default_recovery_handler_' + wsId!
-				})) as any
-				defaultSuccessHandlerMaybe = (await SettingService.getGlobal({
-					key: 'default_success_handler_' + wsId!
-				})) as any
-			}
-
-			if (defaultErrorHandlerMaybe !== undefined && defaultErrorHandlerMaybe !== null) {
-				wsErrorHandlerMuted = defaultErrorHandlerMaybe['wsErrorHandlerMuted']
-				let splitted = (defaultErrorHandlerMaybe['errorHandlerPath'] as string).split('/')
-				errorHandleritemKind = splitted[0] as 'flow' | 'script'
-				errorHandlerPath = splitted.slice(1)?.join('/')
-				errorHandlerExtraArgs = defaultErrorHandlerMaybe['errorHandlerExtraArgs']
-				errorHandlerSelected = getHandlerType('error', errorHandlerPath)
-				failedTimes = defaultErrorHandlerMaybe['failedTimes']
-				failedExact = defaultErrorHandlerMaybe['failedExact']
-			} else {
-				wsErrorHandlerMuted = false
-				errorHandlerPath = undefined
-				errorHandleritemKind = 'script'
-				errorHandlerExtraArgs = {}
-				errorHandlerSelected = 'slack'
-				failedTimes = 1
-				failedExact = false
-			}
-			if (defaultRecoveryHandlerMaybe !== undefined && defaultRecoveryHandlerMaybe !== null) {
-				let splitted = (defaultRecoveryHandlerMaybe['recoveryHandlerPath'] as string).split('/')
-				recoveryHandlerItemKind = splitted[0] as 'flow' | 'script'
-				recoveryHandlerPath = splitted.slice(1)?.join('/')
-				recoveryHandlerExtraArgs = defaultRecoveryHandlerMaybe['recoveryHandlerExtraArgs']
-				recoveryHandlerSelected = getHandlerType('recovery', recoveryHandlerPath)
-				recoveredTimes = defaultRecoveryHandlerMaybe['recoveredTimes']
-			} else {
-				recoveryHandlerPath = undefined
-				recoveryHandlerItemKind = 'script'
-				recoveryHandlerExtraArgs = {}
-				recoveryHandlerSelected = 'slack'
-				recoveredTimes = 1
-			}
-			if (defaultSuccessHandlerMaybe !== undefined && defaultSuccessHandlerMaybe !== null) {
-				let splitted = (defaultSuccessHandlerMaybe['successHandlerPath'] as string).split('/')
-				successHandlerItemKind = splitted[0] as 'flow' | 'script'
-				successHandlerPath = splitted.slice(1)?.join('/')
-				successHandlerExtraArgs = defaultSuccessHandlerMaybe['successHandlerExtraArgs']
-				successHandlerSelected = getHandlerType('success', successHandlerPath)
-				recoveredTimes = defaultSuccessHandlerMaybe['recoveredTimes']
-			} else {
-				successHandlerPath = undefined
-				successHandlerItemKind = 'script'
-				successHandlerExtraArgs = {}
-				successHandlerSelected = 'slack'
-			}
+			const d = wsId ? await loadDefaultScheduleAdvanced(wsId) : emptyScheduleAdvanced()
+			wsErrorHandlerMuted = d.wsErrorHandlerMuted
+			errorHandlerPath = d.errorHandlerPath
+			errorHandleritemKind = d.errorHandleritemKind
+			errorHandlerExtraArgs = d.errorHandlerExtraArgs
+			errorHandlerSelected = d.errorHandlerSelected
+			failedTimes = d.failedTimes
+			failedExact = d.failedExact
+			recoveryHandlerPath = d.recoveryHandlerPath
+			recoveryHandlerItemKind = d.recoveryHandlerItemKind
+			recoveryHandlerExtraArgs = d.recoveryHandlerExtraArgs
+			recoveryHandlerSelected = d.recoveryHandlerSelected
+			recoveredTimes = d.recoveredTimes
+			successHandlerPath = d.successHandlerPath
+			successHandlerItemKind = d.successHandlerItemKind
+			successHandlerExtraArgs = d.successHandlerExtraArgs
+			successHandlerSelected = d.successHandlerSelected
 		}
 	}
 
@@ -328,9 +278,10 @@
 		defaultValues?: Schedule,
 		schedule_path?: string,
 		fixedScriptPath_?: string,
-		opts: { getDraft?: boolean } = {}
+		opts: { getDraft?: boolean; onSaveDraft?: (cfg: Record<string, any>) => boolean } = {}
 	) {
 		const getDraft = opts.getDraft ?? true
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -389,6 +340,7 @@
 			no_flow_overlap = s?.no_flow_overlap ?? false
 			wsErrorHandlerMuted = s?.ws_error_handler_muted ?? false
 			retry = s?.retry ?? undefined
+			dynamicSkipPath = s?.dynamic_skip ?? undefined
 
 			await setScheduleHandler(s)
 			permissionedAs = undefined
@@ -432,93 +384,6 @@
 		}
 	}
 
-	async function saveAsDefaultErrorHandler(overrideExisting: boolean) {
-		if (!$enterpriseLicense) {
-			sendUserToast(`Setting default error handler is an enterprise edition feature`, true)
-			return
-		}
-		if (wsId) {
-			await ScheduleService.setDefaultErrorOrRecoveryHandler({
-				workspace: wsId!,
-				requestBody: {
-					handler_type: 'error',
-					override_existing: overrideExisting,
-					path:
-						errorHandlerPath == undefined
-							? undefined
-							: handlerFullPath(errorHandlerSelected, errorHandleritemKind, errorHandlerPath),
-					extra_args: errorHandlerExtraArgs,
-					number_of_occurence: failedTimes,
-					number_of_occurence_exact: failedExact,
-					workspace_handler_muted: wsErrorHandlerMuted
-				}
-			})
-			if (errorHandlerPath !== undefined) {
-				sendUserToast(`Default error handler saved to ${errorHandlerPath}`, false)
-			} else {
-				sendUserToast(`Default error handler reset`, false)
-			}
-		}
-	}
-
-	async function saveAsDefaultRecoveryHandler(overrideExisting: boolean) {
-		if (!$enterpriseLicense) {
-			sendUserToast(`Setting default recovery handler is an enterprise edition feature`, true)
-			return
-		}
-		if (wsId) {
-			await ScheduleService.setDefaultErrorOrRecoveryHandler({
-				workspace: wsId!,
-				requestBody: {
-					handler_type: 'recovery',
-					override_existing: overrideExisting,
-					path:
-						recoveryHandlerPath === undefined
-							? undefined
-							: handlerFullPath(
-									recoveryHandlerSelected,
-									recoveryHandlerItemKind,
-									recoveryHandlerPath
-								),
-					extra_args: recoveryHandlerExtraArgs,
-					number_of_occurence: recoveredTimes
-				}
-			})
-			if (recoveryHandlerPath !== undefined) {
-				sendUserToast(`Default recovery handler saved to ${recoveryHandlerPath}`, false)
-			} else {
-				sendUserToast(`Default recovery handler reset`, false)
-			}
-		}
-	}
-
-	async function saveAsDefaultSuccessHandler(overrideExisting: boolean) {
-		if (!$enterpriseLicense) {
-			sendUserToast(`Setting default success handler is an enterprise edition feature`, true)
-			return
-		}
-		if (wsId) {
-			await ScheduleService.setDefaultErrorOrRecoveryHandler({
-				workspace: wsId!,
-				requestBody: {
-					handler_type: 'success',
-					override_existing: overrideExisting,
-					path:
-						successHandlerPath === undefined
-							? undefined
-							: handlerFullPath(successHandlerSelected, successHandlerItemKind, successHandlerPath),
-					extra_args: successHandlerExtraArgs,
-					number_of_occurence: recoveredTimes
-				}
-			})
-			if (successHandlerPath !== undefined) {
-				sendUserToast(`Default success handler saved to ${successHandlerPath}`, false)
-			} else {
-				sendUserToast(`Default success handler reset`, false)
-			}
-		}
-	}
-
 	/**
 	 * Apply the deployed config to the form, then return the saved-draft overlay
 	 * so the caller captures `initialConfig` from the deployed-only form BEFORE
@@ -631,6 +496,11 @@
 	async function scheduleScript(): Promise<void> {
 		const previousPath = initialPath
 		const scheduleCfg = getScheduleCfg()
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(scheduleCfg))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const isSaved = await saveScheduleFromCfg(scheduleCfg, edit, wsId!)
 		if (isSaved) {
@@ -641,35 +511,6 @@
 		deploymentLoading = false
 	}
 
-	function getHandlerType(
-		isHandler: 'error' | 'recovery' | 'success',
-		scriptPath: string
-	): ErrorHandler {
-		const handlerMap = {
-			error: {
-				teams: '/workspace-or-schedule-error-handler-teams',
-				slack: '/workspace-or-schedule-error-handler-slack',
-				email: '/workspace-or-error-handler-email'
-			},
-			recovery: {
-				teams: '/schedule-recovery-handler-teams',
-				slack: '/schedule-recovery-handler-slack',
-				email: '/workspace-or-error-handler-email'
-			},
-			success: {
-				teams: '/schedule-success-handler-teams',
-				slack: '/schedule-success-handler-slack',
-				email: '/workspace-or-error-handler-email'
-			}
-		}
-
-		for (const [type, suffix] of Object.entries(handlerMap[isHandler])) {
-			if (scriptPath.startsWith('hub/') && scriptPath.endsWith(suffix)) {
-				return type as ErrorHandler
-			}
-		}
-		return 'custom'
-	}
 
 	let drawer: Drawer | undefined = $state()
 
@@ -705,32 +546,34 @@
 			is_flow: is_flow,
 			args: args,
 			enabled: enabled,
-			on_failure: errorHandlerPath
-				? handlerFullPath(errorHandlerSelected, errorHandleritemKind, errorHandlerPath)
-				: undefined,
-			on_failure_times: failedTimes,
-			on_failure_exact: failedExact,
-			on_failure_extra_args: errorHandlerPath ? errorHandlerExtraArgs : undefined,
-			on_recovery: recoveryHandlerPath
-				? handlerFullPath(recoveryHandlerSelected, recoveryHandlerItemKind, recoveryHandlerPath)
-				: undefined,
-			on_recovery_times: recoveredTimes,
-			on_recovery_extra_args: recoveryHandlerPath ? recoveryHandlerExtraArgs : {},
-			on_success: successHandlerPath
-				? handlerFullPath(successHandlerSelected, successHandlerItemKind, successHandlerPath)
-				: undefined,
-			on_success_extra_args: successHandlerPath ? successHandlerExtraArgs : {},
-			ws_error_handler_muted: wsErrorHandlerMuted,
-			retry: retry,
+			...scheduleAdvancedCfg({
+				errorHandlerSelected,
+				errorHandlerPath,
+				errorHandleritemKind,
+				errorHandlerExtraArgs,
+				wsErrorHandlerMuted,
+				failedTimes,
+				failedExact,
+				recoveryHandlerSelected,
+				recoveryHandlerPath,
+				recoveryHandlerItemKind,
+				recoveryHandlerExtraArgs,
+				recoveredTimes,
+				successHandlerSelected,
+				successHandlerPath,
+				successHandlerItemKind,
+				successHandlerExtraArgs,
+				retry,
+				dynamicSkipPath,
+				tag
+			}),
 			summary: summary != '' ? summary : undefined,
 			labels: labels,
 			description: description,
 			no_flow_overlap: no_flow_overlap,
-			tag: tag,
 			paused_until: paused_until,
 			cron_version: cronVersion,
 			extra_perms: extraPerms,
-			dynamic_skip: dynamicSkipPath,
 			permissioned_as: selectedPermissionedAs,
 			preserve_permissioned_as: preservePermissionedAs || undefined
 		}
@@ -799,6 +642,7 @@
 			onToggleMode={(mode) => handleToggleEnabled(mode === 'enabled')}
 			{isDeployed}
 			disableSuspendedMode
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 		>
 			{#snippet extra()}
 				{#if !drawerLoading && edit}
@@ -1095,367 +939,37 @@
 						]}
 					/>
 				{/snippet}
-				{@render errorHandler()}
+				<ScheduleAdvancedOptions
+					{wsId}
+					{itemKind}
+					canWrite={can_write}
+					{loading}
+					bind:errorHandlerSelected
+					bind:errorHandlerPath
+					bind:errorHandleritemKind
+					bind:errorHandlerExtraArgs
+					bind:wsErrorHandlerMuted
+					bind:failedTimes
+					bind:failedExact
+					bind:recoveryHandlerSelected
+					bind:recoveryHandlerPath
+					bind:recoveryHandlerItemKind
+					bind:recoveryHandlerExtraArgs
+					bind:recoveredTimes
+					bind:successHandlerSelected
+					bind:successHandlerPath
+					bind:successHandlerItemKind
+					bind:successHandlerExtraArgs
+					bind:retry
+					bind:dynamicSkipPath
+					bind:tag
+				/>
 			</Section>
 			<div class="pb-8" />
 		</div>
 	{/if}
 {/snippet}
 
-{#snippet errorHandler()}
-	<div class="flex flex-col gap-2 min-h-96">
-		{#if !loading}
-			<Tabs bind:selected={optionTabSelected}>
-				<Tab value="error_handler" label="Error Handler" />
-				<Tab value="recovery_handler" label="Recovery Handler" />
-				<Tab value="success_handler" label="Success Handler" />
-				<Tab value="retries" label="Retries" />
-				<Tab value="dynamic_skip" label="Dynamic skip" />
-				{#if itemKind === 'script'}
-					<Tab value="tag" label="Custom tag" />
-				{/if}
-			</Tabs>
-			{#if optionTabSelected === 'error_handler'}
-				<Section label="Error handler">
-					{#snippet header()}
-						<div class="flex flex-row gap-2">
-							{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
-						</div>
-					{/snippet}
-					{#snippet action()}
-						<div class="flex flex-row items-center gap-1 text-xs text-secondary">
-							<Dropdown
-								disabled={!can_write}
-								items={[
-									{
-										displayName: `Override future schedules only`,
-										action: () => saveAsDefaultErrorHandler(false)
-									},
-									{
-										displayName: 'Override all existing',
-										type: 'delete',
-										action: () => saveAsDefaultErrorHandler(true)
-									}
-								]}
-							>
-								{#snippet buttonReplacement()}
-									<Save size={12} class="mr-1" />
-									Set as default
-								{/snippet}
-							</Dropdown>
-						</div>
-					{/snippet}
-					<div class="flex flex-row py-2">
-						<Toggle
-							size="xs"
-							disabled={!can_write || !$enterpriseLicense}
-							bind:checked={wsErrorHandlerMuted}
-							options={{ right: 'Mute workspace error handler for this schedule' }}
-						/>
-					</div>
-
-					<ErrorOrRecoveryHandler
-						workspace={wsId}
-						isEditable={can_write}
-						errorOrRecovery="error"
-						showScriptHelpText={true}
-						bind:handlerSelected={errorHandlerSelected}
-						bind:handlerPath={errorHandlerPath}
-						toggleText="Alert channel on error"
-						customScriptTemplate="/scripts/add?hub=hub%2F19743%2Fwindmill%2Fschedule_error_handler_template"
-						bind:customHandlerKind={errorHandleritemKind}
-						bind:handlerExtraArgs={errorHandlerExtraArgs}
-					>
-						{#snippet customTabTooltip()}
-							<Tooltip>
-								<div class="flex gap-20 items-start mt-3">
-									<div class="text-xs"
-										>The following args will be passed to the error handler:
-										<ul class="mt-1 ml-2">
-											<li
-												><b>workspace_id</b>: The ID of the workspace that the schedule belongs to.</li
-											>
-											<li><b>job_id</b>: The UUID of the job that errored.</li>
-											<li><b>path</b>: The path of the script or flow that failed.</li>
-											<li><b>is_flow</b>: Whether the runnable is a flow.</li>
-											<li><b>schedule_path</b>: The path of the schedule.</li>
-											<li><b>error</b>: The error details.</li>
-											<li
-												><b>failed_times</b>: Minimum number of times the schedule failed before
-												calling the error handler.</li
-											>
-											<li><b>started_at</b>: The start datetime of the latest job that failed.</li>
-										</ul>
-									</div>
-								</div>
-							</Tooltip>
-						{/snippet}
-					</ErrorOrRecoveryHandler>
-					<div class="flex flex-row items-center justify-between">
-						<div class="flex flex-row items-center mt-4 font-semibold text-xs gap-2">
-							<p class={emptyString(errorHandlerPath) ? 'text-primary' : ''}>
-								Triggered when schedule failed</p
-							>
-							<select
-								class="!w-14"
-								bind:value={failedExact}
-								disabled={!can_write || !$enterpriseLicense || emptyString(errorHandlerPath)}
-							>
-								<option value={false}>&gt;=</option>
-								<option value={true}>==</option>
-							</select>
-							<input
-								type="number"
-								class="!w-14 text-center {emptyString(errorHandlerPath) ? 'text-primary' : ''}"
-								bind:value={failedTimes}
-								disabled={!can_write || !$enterpriseLicense}
-								min="1"
-							/>
-							<p class={emptyString(errorHandlerPath) ? 'text-primary' : ''}
-								>time{failedTimes > 1 ? 's in a row' : ''}</p
-							>
-						</div>
-					</div>
-				</Section>
-			{:else if optionTabSelected === 'recovery_handler'}
-				{@const disabled = !can_write || emptyString($enterpriseLicense)}
-				<Section label="Recovery handler">
-					{#snippet header()}
-						<div class="flex flex-row gap-2">
-							{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
-						</div>
-					{/snippet}
-					{#snippet action()}
-						<div class="flex flex-row items-center text-secondary text-xs gap-2">
-							defaults
-							<Dropdown
-								{disabled}
-								items={[
-									{
-										displayName: `Override future schedules only`,
-										action: () => saveAsDefaultRecoveryHandler(false)
-									},
-									{
-										displayName: 'Override all existing',
-										type: 'delete',
-										action: () => saveAsDefaultRecoveryHandler(true)
-									}
-								]}
-							>
-								{#snippet buttonReplacement()}
-									<Save size={12} class="mr-1" />
-									Set as default
-								{/snippet}
-							</Dropdown>
-						</div>
-					{/snippet}
-					<ErrorOrRecoveryHandler
-						workspace={wsId}
-						isEditable={!disabled}
-						errorOrRecovery="recovery"
-						bind:handlerSelected={recoveryHandlerSelected}
-						bind:handlerPath={recoveryHandlerPath}
-						toggleText="Alert channel when error recovered"
-						customScriptTemplate="/scripts/add?hub=hub%2F9082%2Fwindmill%2Fschedule_recovery_handler_template"
-						bind:customHandlerKind={recoveryHandlerItemKind}
-						bind:handlerExtraArgs={recoveryHandlerExtraArgs}
-					>
-						{#snippet customTabTooltip()}
-							<Tooltip>
-								<div class="flex gap-20 items-start mt-3">
-									<div class="text-xs"
-										>The following args will be passed to the recovery handler:
-										<ul class="mt-1 ml-2">
-											<li><b>path</b>: The path of the script or flow that recovered.</li>
-											<li><b>is_flow</b>: Whether the runnable is a flow.</li>
-											<li><b>schedule_path</b>: The path of the schedule.</li>
-											<li><b>error</b>: The error of the last job that errored</li>
-											<li
-												><b>error_started_at</b>: The start datetime of the last job that errored</li
-											>
-											<li
-												><b>success_times</b>: The number of times the schedule succeeded before
-												calling the recovery handler.</li
-											>
-											<li><b>success_result</b>: The result of the latest successful job</li>
-											<li
-												><b>success_started_at</b>: The start datetime of the latest successful job</li
-											>
-										</ul>
-									</div>
-								</div>
-							</Tooltip>
-						{/snippet}
-					</ErrorOrRecoveryHandler>
-					<div class="flex flex-row items-center justify-between">
-						<div
-							class="flex flex-row items-center mt-5 font-semibold text-xs {emptyString(
-								recoveryHandlerPath
-							)
-								? 'text-primary'
-								: ''}"
-						>
-							<p>Triggered when schedule recovered</p>
-							<input
-								type="number"
-								class="!w-14 mx-2 text-center"
-								bind:value={recoveredTimes}
-								min="1"
-								{disabled}
-							/>
-							<p>time{recoveredTimes > 1 ? 's in a row' : ''}</p>
-						</div>
-					</div>
-				</Section>
-			{:else if optionTabSelected === 'success_handler'}
-				{@const disabled = !can_write || emptyString($enterpriseLicense)}
-				<Section label="Success handler">
-					{#snippet header()}
-						<div class="flex flex-row gap-2">
-							{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
-						</div>
-					{/snippet}
-					{#snippet action()}
-						<div class="flex flex-row items-center text-secondary text-xs gap-2">
-							defaults
-							<Dropdown
-								{disabled}
-								items={[
-									{
-										displayName: `Override future schedules only`,
-										action: () => saveAsDefaultSuccessHandler(false)
-									},
-									{
-										displayName: 'Override all existing',
-										type: 'delete',
-										action: () => saveAsDefaultSuccessHandler(true)
-									}
-								]}
-							>
-								{#snippet buttonReplacement()}
-									<Save size={12} class="mr-1" />
-									Set as default
-								{/snippet}
-							</Dropdown>
-						</div>
-					{/snippet}
-					<ErrorOrRecoveryHandler
-						workspace={wsId}
-						isEditable={!disabled}
-						errorOrRecovery="success"
-						bind:handlerSelected={successHandlerSelected}
-						bind:handlerPath={successHandlerPath}
-						toggleText="Alert channel when successful"
-						customScriptTemplate="/scripts/add?hub=hub%2F9071%2Fwindmill%2Fschedule_success_handler_template"
-						bind:customHandlerKind={successHandlerItemKind}
-						bind:handlerExtraArgs={successHandlerExtraArgs}
-					>
-						{#snippet customTabTooltip()}
-							<Tooltip>
-								<div class="flex gap-20 items-start mt-3">
-									<div class="text-xs"
-										>The following args will be passed to the success handler:
-										<ul class="mt-1 ml-2">
-											<li><b>path</b>: The path of the script or flow that succeeded.</li>
-											<li><b>is_flow</b>: Whether the runnable is a flow.</li>
-											<li><b>schedule_path</b>: The path of the schedule.</li>
-											<li><b>success_result</b>: The result of the successful job</li>
-											<li><b>success_started_at</b>: The start datetime of the successful job</li>
-										</ul>
-									</div>
-								</div>
-							</Tooltip>
-						{/snippet}
-					</ErrorOrRecoveryHandler>
-				</Section>
-			{:else if optionTabSelected === 'retries'}
-				{@const disabled = !can_write || emptyString($enterpriseLicense)}
-				<Section label="Retries">
-					{#snippet header()}
-						<div class="flex flex-row gap-2">
-							{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
-						</div>
-						<Tooltip>
-							If defined, upon error this schedule will be retried with a delay and a maximum number
-							of attempts as defined below.
-							<br />
-							This is only available for individual script. For flows, retries can be set on each flow
-							step in the flow editor.
-						</Tooltip>
-					{/snippet}
-					{#if itemKind !== 'script'}
-						<Alert type="info" title="Only available for scripts" class="mb-2">
-							Error Handler and Retries are only available for scripts. For flows, use the built-in <a
-								href="https://www.windmill.dev/docs/flows/flow_error_handler"
-								target="_blank">error handler</a
-							>
-							and <a href="https://www.windmill.dev/docs/flows/retries" target="_blank">retries</a>.
-						</Alert>
-					{:else}
-						<FlowRetries
-							bind:flowModuleRetry={retry}
-							disabled={itemKind !== 'script' || disabled}
-						/>
-					{/if}
-				</Section>
-			{:else if optionTabSelected === 'dynamic_skip'}
-				<Section label="Dynamic skip">
-					{#snippet header()}
-						<Tooltip>
-							Optional script to filter scheduled dates. Receives the proposed datetime and returns
-							boolean. True = run on this date, False = skip to next occurrence.
-						</Tooltip>
-					{/snippet}
-					<div class="flex flex-col gap-6">
-						<Label label="Dynamic skip script">
-							<div class="flex flex-row">
-								<ScriptPicker
-									workspace={wsId}
-									disabled={!can_write}
-									bind:scriptPath={dynamicSkipPath}
-									kinds={['script']}
-									allowRefresh={can_write}
-									clearable
-								/>
-								{#if !dynamicSkipPath}
-									<Button
-										btnClasses="ml-4 whitespace-nowrap"
-										variant="default"
-										size="xs"
-										href="/scripts/add?hub=hub%2F19822%2Fwindmill%2Fdynamic_skip_template{wsParam}"
-										disabled={!can_write}
-										target="_blank"
-									>
-										Create from template
-									</Button>
-								{/if}
-							</div>
-						</Label>
-						<Alert type="info" size="xs" title="Handler requirements">
-							Handler must return a boolean value. Return true to execute the scheduled job, false
-							to skip.
-						</Alert>
-					</div>
-				</Section>
-			{:else if optionTabSelected === 'tag'}
-				<Section
-					label="Custom script tag"
-					tooltip="When set, the script tag will be overridden by this tag"
-				>
-					<WorkerTagPicker
-						bind:tag
-						workspaceId={wsId}
-						popupPlacement="top-end"
-						disabled={!can_write}
-					/>
-				</Section>
-			{/if}
-		{:else}
-			<Loader2 class="animate-spin" />
-		{/if}
-	</div>
-{/snippet}
-
 {#snippet drawerBody()}
 	<DrawerContent
 		hideClose={inline && !onClose}
@@ -1465,7 +979,9 @@
 			? can_write
 				? `Edit schedule ${initialPath}`
 				: `View schedule ${initialPath}`
-			: 'New schedule'}
+			: saveDraftHandler
+				? 'Draft schedule'
+				: 'New schedule'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
diff --git a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditor.svelte b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditor.svelte
index 4d593f2e92..f2a6a2b630 100644
--- a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: SqsTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
index 4aee2a8581..0044abbcc1 100644
--- a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
@@ -152,12 +152,17 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
@@ -199,8 +204,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		defaultValues?: Record<string, any>
+		defaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100)
@@ -229,6 +240,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			initialConfig = structuredClone($state.snapshot(getSaveCfg()))
 			clearTimeout(loadingTimeout)
@@ -336,6 +348,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = getSaveCfg()
@@ -406,7 +423,9 @@
 			? can_write
 				? `Edit SQS trigger ${initialPath}`
 				: `SQS trigger ${initialPath}`
-			: 'New SQS trigger'}
+			: saveDraftHandler
+				? 'Draft SQS trigger'
+				: 'New SQS trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -463,6 +482,7 @@
 			isLoading={deploymentLoading}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			{mode}
diff --git a/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte b/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
index 9033aab3cf..218430316a 100644
--- a/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
@@ -16,7 +16,7 @@
 	import ClipboardPanel from '../../details/ClipboardPanel.svelte'
 	import { copyToClipboard, isObject, readFieldsRecursively } from '$lib/utils'
 	// import { page } from '$app/state'
-	import { base } from '$lib/base'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import TriggerTokens from '../TriggerTokens.svelte'
 	import { userStore } from '$lib/stores'
 	import UserSettings from '../../UserSettings.svelte'
@@ -46,7 +46,7 @@
 	const operatingWorkspace = useOperatingWorkspace()
 	const wsId = $derived($operatingWorkspace)
 
-	const WEBHOOK_BASE_URL = $derived(`${location.origin}${base}/api/w/${wsId}/jobs`)
+	const WEBHOOK_BASE_URL = $derived(`${apiBaseUrl()}/api/w/${wsId}/jobs`)
 
 	let baseWebhookUrl = $derived.by(() => {
 		let webhookUrlPath: string
@@ -223,9 +223,7 @@ async function triggerJob() {
 function waitForJobCompletion(UUID) {
   return new Promise(async (resolve, reject) => {
     try {
-      const endpoint = \`${
-				location.origin
-			}/api/w/${wsId}/jobs_u/completed/get_result_maybe/\${UUID}\`;
+      const endpoint = \`${apiBaseUrl()}/api/w/${wsId}/jobs_u/completed/get_result_maybe/\${UUID}\`;
       const checkResponse = await fetch(endpoint, {
         method: 'GET',
         headers: ${JSON.stringify(headers(), null, 2).replaceAll('\n', '\n\t\t\t\t')}
@@ -268,7 +266,7 @@ ${
 		? 'echo -E $RESULT | jq'
 		: requestType === 'async'
 			? `
-URL="${location.origin}/api/w/${wsId}/jobs_u/completed/get_result_maybe/$UUID"
+URL="${apiBaseUrl()}/api/w/${wsId}/jobs_u/completed/get_result_maybe/$UUID"
 while true; do
   curl -s -H "Authorization: Bearer $TOKEN" $URL -o res.json
   COMPLETED=$(cat res.json | jq .completed)
diff --git a/frontend/src/lib/components/tutorials/OperatorTour.svelte b/frontend/src/lib/components/tutorials/OperatorTour.svelte
index cc7f4ab4a5..8c414cac7a 100644
--- a/frontend/src/lib/components/tutorials/OperatorTour.svelte
+++ b/frontend/src/lib/components/tutorials/OperatorTour.svelte
@@ -1,8 +1,7 @@
 <script lang="ts">
 	import type { DriveStep } from 'driver.js'
-	import { wait } from '$lib/utils'
 	import Tutorial from './Tutorial.svelte'
-	import { markOperatorTourSeen, MENU_OPEN_DELAY_MS } from './operatorTour'
+	import { markOperatorTourSeen } from './operatorTour'
 
 	let tutorial: Tutorial | undefined = $state(undefined)
 	let running = false
@@ -25,7 +24,7 @@
 <Tutorial
 	bind:this={tutorial}
 	{onDestroyed}
-	getSteps={(driver) => {
+	getSteps={() => {
 		const steps: DriveStep[] = [
 			{
 				popover: {
@@ -60,19 +59,12 @@
 			},
 			{
 				popover: {
-					title: 'Finally, the Menu section',
+					title: 'Finally, the sidebar',
 					description:
-						'Explore available tabs where you can access your history of runs, your scheduled scripts, and your workspaces.<p style="margin-top: 12px; padding-top: 12px; border-top: 1px solid rgba(128,128,128,0.3); font-size: 0.9em; opacity: 0.9;"><strong>💡 Want to see this again?</strong> Pick <strong>Take the tour</strong> from that same menu.</p>',
-					onNextClick: async () => {
-						// The step points into the menu, so it has to be open before the popover
-						// lands on it — and open is also where the entry to re-run the tour is.
-						const menuButton = document.querySelector('[role="menuitem"]') as HTMLElement | null
-						menuButton?.click()
-						await wait(MENU_OPEN_DELAY_MS)
-						driver.destroy()
-					}
+						'Explore the pages you can open from here: your history of runs, your scheduled scripts and your workspaces.<p style="margin-top: 12px; padding-top: 12px; border-top: 1px solid rgba(128,128,128,0.3); font-size: 0.9em; opacity: 0.9;"><strong>💡 Want to see this again?</strong> Pick <strong>Take the tour</strong> from your account menu, under <strong>Settings</strong>.</p>'
 				},
-				element: '[role="menuitem"]'
+				// Whichever the sidebar currently is: the floating handle when detached, the rail when not.
+				element: '[data-nav-handle], #sidebar'
 			}
 		]
 
diff --git a/frontend/src/lib/components/tutorials/operatorTour.ts b/frontend/src/lib/components/tutorials/operatorTour.ts
index 5c4269e84d..4ece54b66e 100644
--- a/frontend/src/lib/components/tutorials/operatorTour.ts
+++ b/frontend/src/lib/components/tutorials/operatorTour.ts
@@ -13,8 +13,6 @@ export const TOUR_PARAM_VALUE = 'operator'
 
 /** Long enough for the home page's tabs to exist before the first step points at one. */
 export const TOUR_START_DELAY_MS = 500
-/** Time for the sidebar to open before the last step points into it. */
-export const MENU_OPEN_DELAY_MS = 300
 
 export async function hasSeenOperatorTour(): Promise<boolean> {
 	// A failure answers "seen": the tour interrupts the page, and interrupting someone who
diff --git a/frontend/src/lib/components/workspace/WorkspaceCard.svelte b/frontend/src/lib/components/workspace/WorkspaceCard.svelte
index 9da4979cd9..e82b4863c4 100644
--- a/frontend/src/lib/components/workspace/WorkspaceCard.svelte
+++ b/frontend/src/lib/components/workspace/WorkspaceCard.svelte
@@ -12,7 +12,8 @@
 	import WorkspaceIcon from './WorkspaceIcon.svelte'
 	import WorkspaceCard from './WorkspaceCard.svelte'
 	import { twMerge } from 'tailwind-merge'
-	import { devBadgeText, devLabelWord } from '$lib/utils/devWorkspaceLabel'
+	import { devLabelWord } from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 
 	interface ExtendedWorkspace extends UserWorkspace {
 		_children?: ExtendedWorkspace[]
@@ -143,12 +144,12 @@
 							{/if}
 						</span>
 						{#if workspace.is_dev_workspace}
-							<Badge
-								color="dark-blue"
-								small
-								class="text-3xs px-1 py-0 dark:bg-surface-accent-primary text-white dark:text-white"
-								>{devBadgeText(workspace.dev_workspace_label)}</Badge
-							>
+							<DevWorkspaceBadge
+								label={workspace.dev_workspace_label}
+								color={workspace.color}
+								fallbackClass="dark:bg-surface-accent-primary text-white dark:text-white"
+								class="text-3xs px-1 py-0"
+							/>
 						{/if}
 						<span class="text-secondary text-xs">-</span>
 						{#if workspace.id === 'admins'}
diff --git a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
index e6a0dce4fd..5ae952f03e 100644
--- a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
+++ b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
@@ -28,6 +28,7 @@
 		devWorkspacesInChainAbove
 	} from '$lib/utils/workspaceHierarchy'
 	import { useForkableWorkspaces } from '$lib/utils/useForkableWorkspaces.svelte'
+	import { isOperatorInWorkspace } from '$lib/components/sidebar/operatorRoutes'
 	import {
 		fetchProtectionRulesForWorkspace,
 		isRuleUnconditionallyActiveInRulesets
@@ -128,9 +129,14 @@
 	let forkableWorkspaces = $derived(forkable.current)
 
 	// Base candidates are the current workspace's family: its root first, then every fork/dev under it.
+	// Never one the user is an operator in: a fork does not carry the role, so forking such a base
+	// would hand them a full-rights copy of it.
 	let familyRoot = $derived(findWorkspaceRoot($workspaceStore, forkableWorkspaces))
 	let baseCandidates = $derived(
-		familyRoot ? [familyRoot, ...findWorkspaceDescendants(familyRoot.id, forkableWorkspaces)] : []
+		(familyRoot
+			? [familyRoot, ...findWorkspaceDescendants(familyRoot.id, forkableWorkspaces)]
+			: []
+		).filter((w) => !isOperatorInWorkspace(w))
 	)
 	let baseItems = $derived(
 		baseCandidates.map((w) => ({
diff --git a/frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte b/frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte
index 828940fa4a..680421450d 100644
--- a/frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte
@@ -10,7 +10,7 @@
 	import DataTable from '../table/DataTable.svelte'
 	import Head from '../table/Head.svelte'
 	import Row from '../table/Row.svelte'
-	import { KeyRound } from 'lucide-svelte'
+	import { CircleHelp, KeyRound } from 'lucide-svelte'
 	import {
 		FolderService,
 		GroupService,
@@ -25,7 +25,13 @@
 	import { deepEqual } from 'fast-equals'
 	import { ADMIN_DATATABLE_ROLE, isDatatableRoleName } from '../dbTypes'
 	import PgAclEditor from '../datatableAcl/PgAclEditor.svelte'
-	import InstanceRolesButton from './InstanceRolesButton.svelte'
+	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
+	import { createAsyncConfirmationModal } from '../common/confirmationModal/asyncConfirmationModal.svelte'
+	import {
+		pgInstanceName as pgInstanceNameOf,
+		handleRoleCreationError,
+		offerUnusedRoleDrop
+	} from './datatableRoleModals'
 
 	let {
 		workspace,
@@ -44,10 +50,8 @@
 	} = $props()
 
 	// `id` is the instance role's catalog id (or the reserved `admin`), which is what the tenant
-	// lists are keyed by — so renaming a role instance-side moves nothing here. A row without an id
-	// names a role the instance does not define yet: it cannot be saved until a superadmin creates
-	// it, and takes the new role's id once they have.
-	type EditedRole = { id: string | undefined; name: string | undefined; tenants: string[] }
+	// lists are keyed by — so renaming a role instance-side moves nothing here.
+	type EditedRole = { id: string; name: string | undefined; tenants: string[] }
 	type Edited = { permissioned: boolean; roles: EditedRole[]; defaultRoleId: string }
 
 	let drawerOpen = $state(false)
@@ -72,7 +76,7 @@
 
 	const editable = $derived(!!info?.editable)
 	const governing = $derived(info?.governing_workspace_id)
-	// The instance catalog, read again after the instance roles drawer changes it.
+	// The instance catalog, with the roles created from this drawer since it was loaded.
 	let catalog = $state<InstanceDatatableRole[] | undefined>(undefined)
 	const availableRoles: InstanceDatatableRole[] = $derived(catalog ?? info?.available_roles ?? [])
 	// A role is a login on one cluster, and this drawer's is the data table's: name it, or the
@@ -80,11 +84,10 @@
 	const clusterName = $derived(
 		info?.cluster === 'external_instance' ? 'the external cluster' : "Windmill's database"
 	)
+	const pgInstanceName = $derived(pgInstanceNameOf(info?.cluster))
 	const unusedRoles = $derived(availableRoles.filter((r) => !roles.some((row) => row.id === r.id)))
-	const pendingRoles = $derived(roles.filter((r) => r.id === undefined))
-	let instanceRoles: InstanceRolesButton | undefined = $state(undefined)
-
-	const roleKey = (role: EditedRole) => role.id ?? `pending:${role.name}`
+	const confirmationModal = createAsyncConfirmationModal()
+	let aclEditor = $state<PgAclEditor | undefined>(undefined)
 
 	const hasUnsavedChanges = $derived(
 		!deepEqual($state.snapshot(saved), {
@@ -152,9 +155,9 @@
 		roles.push({ id: role.id, name: role.name, tenants: [] })
 	}
 
-	/** Adds a role by name: the instance's role of that name, or a pending row for one it does not
-	 * define yet. */
-	function addRoleByName(typed: string) {
+	/** Adds the instance's role of that name. One the instance does not define is created first,
+	 * which only a superadmin may do. */
+	async function addRoleByName(typed: string) {
 		const name = typed.trim()
 		if (!isDatatableRoleName(name) || name.toLowerCase() === ADMIN_DATATABLE_ROLE) {
 			sendUserToast(
@@ -165,35 +168,70 @@
 		}
 		if (roles.some((r) => r.name === name)) return
 		const existing = availableRoles.find((r) => r.name === name)
-		roles.push({ id: existing?.id, name, tenants: [] })
+		if (existing) {
+			roles.push({ id: existing.id, name, tenants: [] })
+			return
+		}
+		if (!$superadmin) {
+			await confirmationModal.ask({
+				title: `Role ${name} does not exist`,
+				children: `This role doesn't exist in ${pgInstanceName}. Ask a superadmin to create it.`,
+				confirmationText: 'OK',
+				type: 'info',
+				hideCancel: true
+			})
+			return
+		}
+		let created: InstanceDatatableRole | undefined
+		let failure: unknown
+		await confirmationModal.ask({
+			title: `Role ${name} does not exist`,
+			children: `(Superadmin) Create this role in ${pgInstanceName}?`,
+			confirmationText: 'Create role',
+			type: 'info',
+			onConfirmed: async () => {
+				try {
+					created = await SettingService.createInstanceDatatableRole({
+						requestBody: { name, cluster: info?.cluster }
+					})
+				} catch (e) {
+					failure = e
+				}
+			}
+		})
+		if (created) addCreatedRole(created)
+		// Handled once this modal has closed: the take-over offer opens in the same one.
+		if (failure) {
+			await handleRoleCreationError(failure, {
+				name,
+				cluster: info?.cluster,
+				confirmationModal,
+				onTakenOver: addCreatedRole
+			})
+		}
+	}
+
+	function addCreatedRole(created: InstanceDatatableRole) {
+		catalog = [...availableRoles, created]
+		if (!roles.some((r) => r.id === created.id)) {
+			roles.push({ id: created.id, name: created.name, tenants: [] })
+		}
 	}
 
 	function removeRole(role: EditedRole) {
-		const key = roleKey(role)
-		roles = roles.filter((r) => roleKey(r) !== key)
-		if (role.id !== undefined && defaultRoleId === role.id) defaultRoleId = ADMIN_DATATABLE_ROLE
-	}
-
-	/** Reads the instance catalog again and gives each pending row the id of the role now defined
-	 * under its name. */
-	async function refreshCatalog() {
-		let fresh: InstanceDatatableRole[]
-		try {
-			fresh = await SettingService.listInstanceDatatableRoles({ cluster: info?.cluster })
-		} catch (e) {
-			sendUserToast(e?.body ?? e?.message ?? String(e), true)
-			return
-		}
-		catalog = fresh
-		for (const row of roles) {
-			if (row.id !== undefined) continue
-			const created = fresh.find((r) => r.name === row.name)
-			if (created) row.id = created.id
-		}
+		roles = roles.filter((r) => r.id !== role.id)
+		if (defaultRoleId === role.id) defaultRoleId = ADMIN_DATATABLE_ROLE
 	}
 
 	async function save() {
 		saving = true
+		// Turning roles off clears the whole block, so every role it named is removed.
+		const kept = permissioned ? roles.map((r) => r.id) : []
+		const removedIds = saved.permissioned
+			? saved.roles
+					.map((r) => r.id)
+					.filter((id) => id !== ADMIN_DATATABLE_ROLE && !kept.includes(id))
+			: []
 		try {
 			const msg = await WorkspaceService.setDatatablePermissions({
 				workspace,
@@ -201,11 +239,27 @@
 				requestBody: {
 					permissioned,
 					default_role: defaultRoleId,
-					roles: roles.map((r) => ({ id: r.id!, tenants: $state.snapshot(r.tenants) }))
+					roles: roles.map((r) => ({ id: r.id, tenants: $state.snapshot(r.tenants) }))
 				}
 			})
 			sendUserToast(msg)
 			await load()
+			// A role is a login of the whole Postgres instance: whether this was the last data table
+			// naming it is only known once the save has landed.
+			const unused = availableRoles.filter((r) => removedIds.includes(r.id) && r.in_use === false)
+			let dropped = false
+			for (const role of unused) {
+				dropped =
+					(await offerUnusedRoleDrop({
+						role,
+						cluster: info?.cluster,
+						superadmin: !!$superadmin,
+						confirmationModal
+					})) || dropped
+			}
+			if (dropped) await load()
+			// The grants list the roles they can name, which the save just changed.
+			aclEditor?.refresh()
 			onSaved?.()
 		} catch (e) {
 			sendUserToast(e?.body ?? e?.message ?? String(e), true)
@@ -214,6 +268,17 @@
 		}
 	}
 
+	/** Whether the drawer may close: unsaved roles are only lost once the user says so. */
+	async function confirmDiscard(): Promise<boolean> {
+		if (!hasUnsavedChanges || !drawerOpen) return true
+		return await confirmationModal.ask({
+			title: 'Discard unsaved changes?',
+			children: `The roles of ${datatable} have changes that are not saved. Closing the drawer discards them.`,
+			confirmationText: 'Discard changes',
+			type: 'danger'
+		})
+	}
+
 	export function open() {
 		drawerOpen = true
 		load()
@@ -232,10 +297,12 @@
 	/>
 {/if}
 
-<Drawer bind:open={drawerOpen} size="900px">
+<Drawer bind:open={drawerOpen} size="900px" confirmClose={confirmDiscard}>
 	<DrawerContent
-		title="Roles — {datatable}"
-		on:close={() => (drawerOpen = false)}
+		title="Roles: {datatable}"
+		on:close={async () => {
+			if (await confirmDiscard()) drawerOpen = false
+		}}
 		tooltip="A data table role is a Postgres login. A job that names one connects as it, and Postgres decides what it may touch — grant it privileges under Access. Roles are defined for the whole instance; here you say who may use each one on this data table."
 	>
 		{#snippet titleExtra()}
@@ -293,10 +360,13 @@
 				{/if}
 
 				{#if permissioned}
-					{#if editable && availableRoles.length === 0}
-						<Alert type="warning" title="No role defined on this instance" size="xs">
-							Only <span class="font-mono">admin</span> can be used until a superadmin creates a data
-							table role. Type a name below to add one.
+					{#if editable && !$superadmin}
+						<Alert type="info" title="Only superadmins can create roles" size="xs">
+							A data table role is a Postgres login on {pgInstanceName}, so only a superadmin can
+							create one. Ask a superadmin for any role you need that is not listed.
+							{#if availableRoles.length === 0}
+								Until then, only <span class="font-mono">admin</span> can be used.
+							{/if}
 						</Alert>
 					{/if}
 
@@ -329,7 +399,7 @@
 							</tr>
 						</Head>
 						<tbody class="divide-y bg-surface-tertiary">
-							{#each roles as role (roleKey(role))}
+							{#each roles as role (role.id)}
 								{@const isAdmin = role.id === ADMIN_DATATABLE_ROLE}
 								<Row>
 									<Cell first class="w-56 align-top">
@@ -339,23 +409,6 @@
 												<span class="text-2xs text-secondary italic">
 													no longer defined on {clusterName}
 												</span>
-											{:else if role.id === undefined}
-												<Alert type="warning" title="This role does not exist yet" size="xs">
-													{#if $superadmin}
-														<div class="flex flex-col items-start gap-1">
-															<span>Create it on {clusterName} to use it here.</span>
-															<Button
-																unifiedSize="xs"
-																variant="default"
-																on:click={() => instanceRoles?.open(role.name)}
-															>
-																Create it
-															</Button>
-														</div>
-													{:else}
-														Only a superadmin can create it on {clusterName}.
-													{/if}
-												</Alert>
 											{/if}
 										</div>
 									</Cell>
@@ -371,11 +424,11 @@
 									<Cell class="w-20 align-top">
 										<div class="flex justify-center pt-2">
 											<Checkbox
-												checked={role.id !== undefined && defaultRoleId === role.id}
-												disabled={!editable || role.id === undefined}
+												checked={defaultRoleId === role.id}
+												disabled={!editable}
 												title="Use this role when a job names none"
 												onChange={() => {
-													if (role.id !== undefined) defaultRoleId = role.id
+													defaultRoleId = role.id
 												}}
 											/>
 										</div>
@@ -388,7 +441,7 @@
 								</Row>
 							{/each}
 							{#if editable}
-								<Row class="!border-0">
+								<Row>
 									<Cell colspan={4} class="pt-2 pb-2">
 										<div class="flex justify-center">
 											<Select
@@ -418,9 +471,32 @@
 
 			<!-- Grants only matter to a data table under roles: without them every job connects as the
 			default login, whatever is granted here. -->
-			{#if info?.supported && permissioned && !hasUnsavedChanges}
+			{#if info?.supported && permissioned}
 				<div class="mt-6 pt-6 border-t">
-					<PgAclEditor {workspace} {datatable} target={{ kind: 'database' }} />
+					<PgAclEditor
+						bind:this={aclEditor}
+						{workspace}
+						{datatable}
+						target={{ kind: 'database' }}
+						disabledReason={hasUnsavedChanges ? 'Save the new roles to continue' : undefined}
+					/>
+					<div class="mt-3">
+						<Button
+							unifiedSize="xs"
+							variant="subtle"
+							startIcon={{ icon: CircleHelp }}
+							on:click={() =>
+								confirmationModal.ask({
+									title: 'Permissions on schemas and tables',
+									children: `<p>In the database manager, click the <b>⋮</b> menu of a schema or a table, then <b>Access</b>, to add grants on it or change its owner.</p>`,
+									confirmationText: 'OK',
+									type: 'info',
+									hideCancel: true
+								})}
+						>
+							How to use permissions on schemas and tables?
+						</Button>
+					</div>
 				</div>
 			{/if}
 		{/if}
@@ -430,10 +506,7 @@
 				<Button
 					variant="accent"
 					unifiedSize="md"
-					disabled={!hasUnsavedChanges || loading || !!loadError || pendingRoles.length > 0}
-					title={pendingRoles.length > 0
-						? 'Create the roles that do not exist yet, or remove them'
-						: undefined}
+					disabled={!hasUnsavedChanges || loading || !!loadError}
 					loading={saving}
 					on:click={save}
 				>
@@ -444,11 +517,4 @@
 	</DrawerContent>
 </Drawer>
 
-{#if $superadmin}
-	<InstanceRolesButton
-		bind:this={instanceRoles}
-		hideTrigger
-		cluster={info?.cluster}
-		onChanged={refreshCatalog}
-	/>
-{/if}
+<ConfirmationModal {...confirmationModal.props} />
diff --git a/frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte b/frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte
index 4997bafac7..2bb0567bf3 100644
--- a/frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte
@@ -15,6 +15,7 @@
 	import { SettingService, type DatatableRoleCluster, type InstanceDatatableRole } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import { isCloudHosted } from '$lib/cloud'
+	import { handleRoleCreationError } from './datatableRoleModals'
 
 	let {
 		initialName = '',
@@ -134,14 +135,28 @@
 	async function create() {
 		const name = newName.trim()
 		if (!name) return
-		await run(
-			() =>
-				SettingService.createInstanceDatatableRole({
-					requestBody: { name, cluster }
-				}),
-			`Created the data table role ${name}`
-		)
-		newName = ''
+		busy = true
+		try {
+			await SettingService.createInstanceDatatableRole({ requestBody: { name, cluster } })
+			sendUserToast(`Created the data table role ${name}`)
+			newName = ''
+		} catch (e) {
+			const createdOn = cluster
+			handleRoleCreationError(e, {
+				name,
+				cluster: createdOn,
+				confirmationModal,
+				onTakenOver: async () => {
+					newName = ''
+					if (cluster === createdOn) await load()
+					onChanged?.()
+				}
+			})
+		} finally {
+			await load()
+			busy = false
+			onChanged?.()
+		}
 	}
 
 	async function remove(role: InstanceDatatableRole) {
diff --git a/frontend/src/lib/components/workspaceSettings/datatableRoleModals.ts b/frontend/src/lib/components/workspaceSettings/datatableRoleModals.ts
new file mode 100644
index 0000000000..66b5b2ecbc
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/datatableRoleModals.ts
@@ -0,0 +1,120 @@
+import { SettingService, type DatatableRoleCluster, type InstanceDatatableRole } from '$lib/gen'
+import { sendUserToast } from '$lib/toast'
+import type { ConfirmationModalHandle } from '../common/confirmationModal/asyncConfirmationModal.svelte'
+
+export function pgInstanceName(cluster: DatatableRoleCluster | undefined): string {
+	return cluster === 'external_instance'
+		? 'the external Postgres instance'
+		: 'the Windmill Postgres instance'
+}
+
+function escapeHtml(text: string): string {
+	return text.replace(
+		/[&<>"']/g,
+		(c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]!
+	)
+}
+
+/** Reports a failed role creation. One refused because Postgres already has a role of that name
+ * (a 409) opens the offer to take that role over instead. `confirmationModal` must be closed: the
+ * offer takes it over. */
+export async function handleRoleCreationError(
+	e: any,
+	opts: {
+		name: string
+		cluster: DatatableRoleCluster | undefined
+		confirmationModal: ConfirmationModalHandle
+		onTakenOver: (role: InstanceDatatableRole) => void
+	}
+) {
+	if (e?.status !== 409) {
+		sendUserToast(e?.body ?? e?.message ?? String(e), true)
+		return
+	}
+	await offerTakeover(opts)
+}
+
+/** A role no data table names any more is still a login on its Postgres instance. A superadmin is
+ * offered to drop it; anyone else is told to ask one. Resolves to whether it was dropped. */
+export async function offerUnusedRoleDrop({
+	role,
+	cluster,
+	superadmin,
+	confirmationModal
+}: {
+	role: InstanceDatatableRole
+	cluster: DatatableRoleCluster | undefined
+	superadmin: boolean
+	confirmationModal: ConfirmationModalHandle
+}): Promise<boolean> {
+	const name = `<span class="font-mono">${escapeHtml(role.name)}</span>`
+	const instance = pgInstanceName(cluster)
+	if (!superadmin) {
+		await confirmationModal.ask({
+			title: `Role ${role.name} is no longer used`,
+			children: `<p>No data table uses the role ${name} any more, but its login still exists in ${instance}. Ask a superadmin to drop it there.</p>`,
+			confirmationText: 'OK',
+			type: 'info',
+			hideCancel: true
+		})
+		return false
+	}
+	let dropped = false
+	await confirmationModal.ask({
+		title: `Drop the role ${role.name}?`,
+		children: `<div class="flex flex-col gap-2">
+			<p>No data table uses the role ${name} any more, but its login still exists in ${instance}. Windmill can drop it.</p>
+			<p>Dropping it <b>deletes the login ${name}</b> from ${instance}: anything still connecting as it, such as a script with <span class="font-mono">-- role ${escapeHtml(role.name)}</span>, fails from then on. Everything it owns in the databases Windmill manages there is handed back to admin, and its grants are revoked. This cannot be undone.</p>
+			<p>Keep it if you plan to give it to a data table again.</p>
+		</div>`,
+		confirmationText: 'Drop role',
+		type: 'danger',
+		onConfirmed: async () => {
+			try {
+				await SettingService.deleteInstanceDatatableRole({ id: role.id })
+				dropped = true
+				sendUserToast(`Dropped the role ${role.name}`)
+			} catch (e) {
+				sendUserToast(e?.body ?? e?.message ?? String(e), true)
+			}
+		}
+	})
+	return dropped
+}
+
+async function offerTakeover({
+	name,
+	cluster,
+	confirmationModal,
+	onTakenOver
+}: {
+	name: string
+	cluster: DatatableRoleCluster | undefined
+	confirmationModal: ConfirmationModalHandle
+	onTakenOver: (role: InstanceDatatableRole) => void
+}) {
+	const role = `<span class="font-mono">${escapeHtml(name)}</span>`
+	let taken: InstanceDatatableRole | undefined
+	await confirmationModal.ask({
+		title: `Let Windmill take over the role ${name}?`,
+		children: `<div class="flex flex-col gap-2">
+			<p>A Postgres role named ${role} already exists in ${pgInstanceName(cluster)}, and Windmill did not create it. A data table role logs in with a password only Windmill knows, so Windmill has to manage it to use it.</p>
+			<p>Taking it over <b>replaces the password of ${role}</b> with a random one and lets it log in. Anything that logs in as ${role} today with its current password, such as another application, a person or another Windmill instance, will be locked out. The old password cannot be restored.</p>
+			<p>From then on Windmill manages ${role} like a role it created: deleting it in Windmill drops it from Postgres. A role that is a superuser, can create roles or databases, is a member of other roles or has members of its own is refused.</p>
+		</div>`,
+		confirmationText: 'Replace password and take over',
+		type: 'danger',
+		onConfirmed: async () => {
+			try {
+				taken = await SettingService.createInstanceDatatableRole({
+					requestBody: { name, cluster, take_over: true }
+				})
+			} catch (e) {
+				sendUserToast(e?.body ?? e?.message ?? String(e), true)
+			}
+		}
+	})
+	if (!taken) return
+	sendUserToast(`Windmill now manages the role ${name}`)
+	onTakenOver(taken)
+}
diff --git a/frontend/src/lib/instanceUi.ts b/frontend/src/lib/instanceUi.ts
index b9b87d139c..3a7bb1b99c 100644
--- a/frontend/src/lib/instanceUi.ts
+++ b/frontend/src/lib/instanceUi.ts
@@ -2,7 +2,8 @@ import { writable } from 'svelte/store'
 import type { GetInstanceUiResponse } from '$lib/gen'
 
 /**
- * The last `/settings/instance_ui` response: the announcement banner and accent color.
+ * The last `/settings/instance_ui` response: the announcement banner, accent color
+ * and API base url.
  * `undefined` until one lands, and left as is when a fetch fails, so a transient error
  * never retracts an announcement still in force. Written only by `InstanceUiSync`.
  */
diff --git a/frontend/src/lib/logout.test.ts b/frontend/src/lib/logout.test.ts
index 160bce9934..5bdc15bac3 100644
--- a/frontend/src/lib/logout.test.ts
+++ b/frontend/src/lib/logout.test.ts
@@ -12,9 +12,25 @@ import { clearUser } from './logout'
 describe('clearUser', () => {
 	beforeEach(() => {
 		sessionStorage.clear()
+		localStorage.clear()
 		vi.clearAllMocks()
 	})
 
+	it('drops credential-bearing localStorage entries and keeps preferences', async () => {
+		const credentialKeys = ['oauth-callback', 'mcp-oauth-callback', 'test_dev_token']
+		for (const key of credentialKeys) {
+			localStorage.setItem(key, 'a-token')
+		}
+		localStorage.setItem('dark-mode', 'true')
+
+		await clearUser()
+
+		for (const key of credentialKeys) {
+			expect(localStorage.getItem(key)).toBeNull()
+		}
+		expect(localStorage.getItem('dark-mode')).toBe('true')
+	})
+
 	// Logging out while impersonating must not leave the impersonator's own token behind.
 	it('drops the impersonation token backup', async () => {
 		sessionStorage.setItem('pre_impersonation_token', 'a-token')
diff --git a/frontend/src/lib/logout.ts b/frontend/src/lib/logout.ts
index 58fce16fe3..b4782badd3 100644
--- a/frontend/src/lib/logout.ts
+++ b/frontend/src/lib/logout.ts
@@ -6,15 +6,19 @@ import { clearStores } from './storeUtils'
 // Note: logout and logoutWithRedirect have been moved to logoutKit.ts
 // as they depend on SvelteKit navigation
 
-// The impersonation backup holds the impersonator's own auth token, so it must go on
-// logout too, not only when impersonation is ended from the banner — otherwise a usable
-// token stays readable for the lifetime of the tab.
-function clearImpersonationFromStorage(): void {
+// Every browser-storage entry that can hold a credential must go on logout. The impersonation
+// backup is the impersonator's own auth token; `oauth-callback` and `mcp-oauth-callback` carry a
+// connected account's token response when the OAuth popup had no opener to post it to;
+// `test_dev_token` is the session token of the /test_dev pages.
+function clearCredentialsFromStorage(): void {
 	try {
 		sessionStorage.removeItem('pre_impersonation_token')
 		sessionStorage.removeItem('pre_impersonation_email')
+		localStorage.removeItem('oauth-callback')
+		localStorage.removeItem('mcp-oauth-callback')
+		localStorage.removeItem('test_dev_token')
 	} catch (e) {
-		console.error('error interacting with session storage', e)
+		console.error('error interacting with browser storage', e)
 	}
 }
 
@@ -23,7 +27,7 @@ export async function clearUser() {
 		noteSessionEmail(undefined)
 		accountSetup.reset()
 		clearStores()
-		clearImpersonationFromStorage()
+		clearCredentialsFromStorage()
 		await UserService.logout()
 	} catch (error) {}
 }
diff --git a/frontend/src/lib/mcpEndpointTools.ts b/frontend/src/lib/mcpEndpointTools.ts
index 2197998857..e0c29f4d7b 100644
--- a/frontend/src/lib/mcpEndpointTools.ts
+++ b/frontend/src/lib/mcpEndpointTools.ts
@@ -2028,7 +2028,7 @@ export const mcpEndpointTools: EndpointTool[] = [
                                 },
                                 "exponential": {
                                         "type": "object",
-                                        "description": "Retry with exponential backoff (delay doubles each time)",
+                                        "description": "Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n",
                                         "properties": {
                                                 "attempts": {
                                                         "type": "integer",
@@ -2041,7 +2041,7 @@ export const mcpEndpointTools: EndpointTool[] = [
                                                 "seconds": {
                                                         "type": "integer",
                                                         "minimum": 1,
-                                                        "description": "Initial delay in seconds"
+                                                        "description": "Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too"
                                                 },
                                                 "random_factor": {
                                                         "type": "integer",
@@ -2232,7 +2232,7 @@ export const mcpEndpointTools: EndpointTool[] = [
                                 },
                                 "exponential": {
                                         "type": "object",
-                                        "description": "Retry with exponential backoff (delay doubles each time)",
+                                        "description": "Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n",
                                         "properties": {
                                                 "attempts": {
                                                         "type": "integer",
@@ -2245,7 +2245,7 @@ export const mcpEndpointTools: EndpointTool[] = [
                                                 "seconds": {
                                                         "type": "integer",
                                                         "minimum": 1,
-                                                        "description": "Initial delay in seconds"
+                                                        "description": "Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too"
                                                 },
                                                 "random_factor": {
                                                         "type": "integer",
diff --git a/frontend/src/lib/pipelinePaths.ts b/frontend/src/lib/pipelinePaths.ts
index 534e691479..d12b162e06 100644
--- a/frontend/src/lib/pipelinePaths.ts
+++ b/frontend/src/lib/pipelinePaths.ts
@@ -9,6 +9,11 @@ export function pipelineBundlePath(folder: string): string {
 	return `f/${folder}/${PIPELINE_DRAFT_KIND}`
 }
 
+/** localStorage key of the editor's crash mirror of a folder's bundle. */
+export function pipelineLocalMirrorKey(folder: string): string {
+	return `pipeline-${folder}`
+}
+
 const BUNDLE_PATH_RE = new RegExp(`^f/([^/]+)/${PIPELINE_DRAFT_KIND}$`)
 
 /** The folder a pipeline bundle belongs to, or `undefined` if the path isn't one. */
diff --git a/frontend/src/lib/script_helpers.ts b/frontend/src/lib/script_helpers.ts
index 25ac64e607..b909aed43f 100644
--- a/frontend/src/lib/script_helpers.ts
+++ b/frontend/src/lib/script_helpers.ts
@@ -3,6 +3,7 @@ import { type Script } from './gen'
 import type { SupportedLanguage } from './common'
 
 import CLAUDE_SANDBOX_INIT_CODE from './templates/claude_sandbox.ts.template?raw'
+import PI_SANDBOX_INIT_CODE from './templates/pi_sandbox.ts.template?raw'
 import WAC_PYTHON_INIT_CODE from './templates/wac_python.py.template?raw'
 import WAC_TYPESCRIPT_INIT_CODE from './templates/wac_typescript.ts.template?raw'
 import CI_TEST_BUN_INIT_CODE from './templates/ci_test_bun.ts.template?raw'
@@ -1500,6 +1501,9 @@ export const INITIAL_CODE = {
 	claudesandbox: {
 		script: CLAUDE_SANDBOX_INIT_CODE
 	},
+	pisandbox: {
+		script: PI_SANDBOX_INIT_CODE
+	},
 	wac_python: {
 		script: WAC_PYTHON_INIT_CODE
 	},
@@ -1563,6 +1567,7 @@ export function initialCode(
 		| 'powershell'
 		| 'bunnative'
 		| 'claudesandbox'
+		| 'pisandbox'
 		| 'wac_python'
 		| 'wac_typescript'
 		| 'ci_test_bun'
@@ -1670,6 +1675,8 @@ export function initialCode(
 	} else if (language == 'bun' || language == 'bunnative') {
 		if (subkind === 'claudesandbox') {
 			return INITIAL_CODE.claudesandbox.script
+		} else if (subkind === 'pisandbox') {
+			return INITIAL_CODE.pisandbox.script
 		} else if (kind == 'trigger') {
 			return INITIAL_CODE.bun.trigger
 		} else if (language == 'bunnative' || subkind === 'bunnative') {
@@ -1711,6 +1718,7 @@ export function getResetCode(
 		| 'powershell'
 		| 'bunnative'
 		| 'claudesandbox'
+		| 'pisandbox'
 		| 'wac_python'
 		| 'wac_typescript'
 		| 'ci_test_bun'
diff --git a/frontend/src/lib/templates/pi_sandbox.ts.template b/frontend/src/lib/templates/pi_sandbox.ts.template
new file mode 100644
index 0000000000..ce99d549f7
--- /dev/null
+++ b/frontend/src/lib/templates/pi_sandbox.ts.template
@@ -0,0 +1,74 @@
+// sandbox
+// volume: pi .pi
+
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { createModels } from "@earendil-works/pi-ai/models";
+import { anthropicProvider } from "@earendil-works/pi-ai/providers/anthropic";
+import { AssistantEntry, createRegistry, Harness, watchEvents } from "@earendil-works/pi-durable";
+import { NodeExecutionEnv } from "@earendil-works/pi-durable/env/node";
+import { openNodeJsonlStorage } from "@earendil-works/pi-durable/storage/jsonl/node";
+import { CodingTools } from "@earendil-works/pi-durable/tools";
+
+export async function main(anthropic: RT.Anthropic, instructions?: string) {
+  // Any pi-ai provider works: import it from "@earendil-works/pi-ai/providers/<name>",
+  // set the API key env var it reads, and name it in `model` below.
+  process.env.ANTHROPIC_API_KEY = anthropic.apiKey;
+  const models = createModels();
+  models.setProvider(anthropicProvider());
+  const model = { provider: "anthropic", modelId: "claude-opus-5-5" };
+
+  // read, write, edit and bash, running in this job's sandbox
+  const registry = createRegistry();
+  registry.install(CodingTools);
+
+  const context = BACKGROUND_CONTEXT;
+
+  // The conversation is stored in the volume, so each run continues the previous one.
+  const harness = await Harness.open(
+    await openNodeJsonlStorage(".pi/session", context),
+    { models, registry, env: ({ cwd }) => new NodeExecutionEnv({ cwd: cwd ?? process.cwd() }) },
+    context,
+  );
+
+  try {
+    const root = await harness.root(context);
+    await root.configure({ model, instructions: instructions ?? null }, context);
+
+    const isResume = (await root.viewState(context)).value.entries.length > 0;
+
+    // you can hardcode the prompt or pass it as input.
+    const prompt = !isResume ?
+      "What is the fastest OSS workflow engine?" :
+      "What did I ask you before?"
+
+    const events = await watchEvents(harness, root.id, context);
+    events.start(async (batch) => {
+      for (const event of batch) {
+        if (event.type === "tool_execution_start") {
+          console.log(`${event.toolName} ${JSON.stringify(event.args)}`);
+        }
+      }
+    });
+
+    const submission = await root.submit({ type: "input", content: prompt }, context);
+    const settled = await submission.wait(context);
+    if (settled.status !== "done" || settled.type !== "input") {
+      throw new Error(`Pi did not answer: ${JSON.stringify(settled)}`);
+    }
+
+    const answer = await root.commit((tx) => tx.entry(AssistantEntry, settled.answer), context);
+    const response = (answer?.model?.[0]?.content ?? [])
+      .filter((b: any) => b.type === "text")
+      .map((b: any) => b.text)
+      .join("");
+
+    return {
+      is_resume: isResume,
+      prompt,
+      response,
+      usage: (await harness.usage(context)).models,
+    };
+  } finally {
+    await harness.close(context);
+  }
+}
diff --git a/frontend/src/lib/user.ts b/frontend/src/lib/user.ts
index 006c2ab60c..12d6f237ba 100644
--- a/frontend/src/lib/user.ts
+++ b/frontend/src/lib/user.ts
@@ -1,5 +1,6 @@
-import { type User, UserService } from '$lib/gen'
+import { UserService } from '$lib/gen'
 import type { UserExt } from './stores.js'
+import { mapUserToUserExt } from './userExt'
 
 async function fetchUserExt(workspace: string): Promise<UserExt> {
 	return mapUserToUserExt(await UserService.whoami({ workspace }), workspace)
@@ -42,16 +43,3 @@ export function getWorkspaceRole(workspace: string): Promise<RoleLookup> {
 export function clearWorkspaceRoleCache(): void {
 	workspaceRoleCache.clear()
 }
-
-function mapUserToUserExt(user: User, workspace: string): UserExt {
-	const ext: UserExt = {
-		...user,
-		workspace_id: workspace,
-		groups: user.groups!,
-		pgroups: user.groups!.map((x) => `g/${x}`)
-	}
-	if (ext.is_service_account && sessionStorage.getItem('pre_impersonation_token')) {
-		ext.impersonating_email = sessionStorage.getItem('pre_impersonation_email') ?? undefined
-	}
-	return ext
-}
diff --git a/frontend/src/lib/userExt.ts b/frontend/src/lib/userExt.ts
new file mode 100644
index 0000000000..d06e1cd04d
--- /dev/null
+++ b/frontend/src/lib/userExt.ts
@@ -0,0 +1,15 @@
+import type { User } from '$lib/gen/types.gen'
+import type { UserExt } from './stores'
+
+export function mapUserToUserExt(user: User, workspace: string): UserExt {
+	const ext: UserExt = {
+		...user,
+		workspace_id: workspace,
+		groups: user.groups!,
+		pgroups: user.groups!.map((x) => `g/${x}`)
+	}
+	if (ext.is_service_account && sessionStorage.getItem('pre_impersonation_token')) {
+		ext.impersonating_email = sessionStorage.getItem('pre_impersonation_email') ?? undefined
+	}
+	return ext
+}
diff --git a/frontend/src/lib/utils.ts b/frontend/src/lib/utils.ts
index ec112607fd..8540b964e8 100644
--- a/frontend/src/lib/utils.ts
+++ b/frontend/src/lib/utils.ts
@@ -1322,28 +1322,7 @@ export function isCodeInjection(expr: string | undefined): boolean {
 	return dynamicTemplateRegex.test(expr)
 }
 
-// Query params Windmill consumes internally and that should not be exposed to
-// app logic via the `query` context. Only params we actually own are listed
-// here — the `wm_` prefix is a naming convention, not a reserved namespace, so
-// we don't strip it wholesale (that would break apps reading their own `wm_*`
-// params). `wm_coep` is a transport flag for cross-origin isolation headers;
-// `wm_embed`/`wm_embedder_origin` are the opaque app viewer transport params
-// (see PublicAppFrame).
-export const WINDMILL_RESERVED_QUERY_PARAMS = new Set(['wm_coep', 'wm_embed', 'wm_embedder_origin'])
-
-export function urlParamsToObject(
-	params: URLSearchParams,
-	opts?: { stripReserved?: boolean }
-): Record<string, string> {
-	const result: Record<string, string> = {}
-	params.forEach((value, key) => {
-		if (opts?.stripReserved && WINDMILL_RESERVED_QUERY_PARAMS.has(key)) {
-			return
-		}
-		result[key] = value
-	})
-	return result
-}
+export { WINDMILL_RESERVED_QUERY_PARAMS, urlParamsToObject } from './utils/queryParams'
 
 export async function tryEvery({
 	tryCode,
diff --git a/frontend/src/lib/utils/describeCron.test.ts b/frontend/src/lib/utils/describeCron.test.ts
index a39c970cb9..34d5429386 100644
--- a/frontend/src/lib/utils/describeCron.test.ts
+++ b/frontend/src/lib/utils/describeCron.test.ts
@@ -3,35 +3,39 @@ import { describeCron, describeSchedule } from './describeCron'
 
 describe('describeCron', () => {
 	it.each([
-		['*/30 * * * * *', 'Every 30s'],
-		['0 * * * * *', 'Every minute'],
-		['0 */15 * * * *', 'Every 15 min'],
-		['0 0 * * * *', 'Hourly'],
-		['0 30 * * * *', 'Hourly at :30'],
-		['0 0 */6 * * *', 'Every 6h'],
-		['0 0 4 * * *', 'Daily, 4:00'],
+		['*/30 * * * * *', 'Every 30 seconds', 'Every 30s'],
+		['0 * * * * *', 'Every minute', 'Every minute'],
+		['0 */15 * * * *', 'Every 15 minutes', 'Every 15 min'],
+		['0 0 * * * *', 'Every hour', 'Hourly'],
+		['0 30 * * * *', 'Every hour at :30', 'Hourly at :30'],
+		['0 0 */6 * * *', 'Every 6 hours', 'Every 6h'],
+		['0 0 4 * * *', 'Every day at 4:00', 'Daily, 4:00'],
 		// five fields are padded at the end, like the schedule editor saves them
-		['0 0 12 * *', 'Daily, 12:00'],
-		['0 30 9 * * 1-5', 'Weekdays, 9:30'],
-		['0 0 9 * * MON', 'Mondays, 9:00'],
-		['0 0 18 * * 1,3,5', 'Mon/Wed/Fri, 18:00'],
-		['0 0 8 1 * *', 'Monthly on the 1st, 8:00'],
-		['0 0 8 22 * *', 'Monthly on the 22nd, 8:00']
-	])('%s → %s', (cron, text) => {
-		expect(describeCron(cron)).toBe(text)
+		['0 0 12 * *', 'Every day at 12:00', 'Daily, 12:00'],
+		['0 30 9 * * 1-5', 'Every weekday at 9:30', 'Weekdays, 9:30'],
+		['0 0 9 * * MON', 'Every Monday at 9:00', 'Mondays, 9:00'],
+		['0 0 18 * * 1,3,5', 'Every Monday, Wednesday and Friday at 18:00', 'Mon/Wed/Fri, 18:00'],
+		['0 0 8 1 * *', 'Every month on the 1st at 8:00', 'Monthly on the 1st, 8:00'],
+		['0 0 8 22 * *', 'Every month on the 22nd at 8:00', 'Monthly on the 22nd, 8:00']
+	])('%s → %s / %s', (cron, sentence, compact) => {
+		expect(describeCron(cron)).toBe(sentence)
+		expect(describeCron(cron, { compact: true })).toBe(compact)
 	})
 
 	it.each(['0 0 8 1 1 *', '15 0 4 * * *', '0 0 4-6 * * *', 'not a cron'])(
 		'leaves %s to be shown as is',
 		(cron) => {
 			expect(describeCron(cron)).toBeUndefined()
+			expect(describeCron(cron, { compact: true })).toBeUndefined()
 		}
 	)
 })
 
 describe('describeSchedule', () => {
 	it('names the zone of a wall-clock time only', () => {
-		expect(describeSchedule('0 0 12 * * *', 'UTC')).toBe('Daily, 12:00 UTC')
-		expect(describeSchedule('0 0 * * * *', 'UTC')).toBe('Hourly')
+		expect(describeSchedule('0 0 12 * * *', 'UTC')).toBe('Every day at 12:00 UTC')
+		expect(describeSchedule('0 0 12 * * *', 'UTC', { compact: true })).toBe('Daily, 12:00 UTC')
+		expect(describeSchedule('0 0 * * * *', 'UTC')).toBe('Every hour')
+		expect(describeSchedule('0 30 * * * *', 'UTC', { compact: true })).toBe('Hourly at :30')
 	})
 })
diff --git a/frontend/src/lib/utils/describeCron.ts b/frontend/src/lib/utils/describeCron.ts
index 3b47c986b1..1cded04ab6 100644
--- a/frontend/src/lib/utils/describeCron.ts
+++ b/frontend/src/lib/utils/describeCron.ts
@@ -50,22 +50,64 @@ function days(field: string): number[] | undefined {
 	return [...out].sort()
 }
 
-function listDays(ds: number[]): string {
-	if (ds.join() === '1,2,3,4,5') return 'Weekdays'
-	if (ds.join() === '0,6') return 'Weekends'
-	if (ds.length === 1) return `${DAY_NAMES[ds[0]]}s`
-	return ds.map((d) => DAY_NAMES[d].slice(0, 3)).join('/')
+export type CronDescriptionOptions = {
+	/** Terse wording for tight cells — "Daily, 4:00", "Mon/Wed/Fri, 18:00" — instead of
+	 * a sentence — "Every day at 4:00", "Every Monday, Wednesday and Friday at 18:00". */
+	compact?: boolean
+}
+
+/** The wording of each cadence, in sentence and compact form. */
+const WORDS = {
+	sentence: {
+		everySeconds: (n: string) => `Every ${n} seconds`,
+		everyMinutes: (n: string) => `Every ${n} minutes`,
+		hourly: 'Every hour',
+		hourlyAt: (m: string) => `Every hour at :${m}`,
+		everyHours: (n: string) => `Every ${n} hours`,
+		daily: (t: string) => `Every day at ${t}`,
+		onDays: (ds: number[], t: string) => {
+			if (ds.join() === '1,2,3,4,5') return `Every weekday at ${t}`
+			if (ds.join() === '0,6') return `Every weekend day at ${t}`
+			const names = ds.map((d) => DAY_NAMES[d])
+			const list =
+				names.length === 1
+					? names[0]
+					: `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`
+			return `Every ${list} at ${t}`
+		},
+		monthly: (day: string, t: string) => `Every month on the ${day} at ${t}`
+	},
+	compact: {
+		everySeconds: (n: string) => `Every ${n}s`,
+		everyMinutes: (n: string) => `Every ${n} min`,
+		hourly: 'Hourly',
+		hourlyAt: (m: string) => `Hourly at :${m}`,
+		everyHours: (n: string) => `Every ${n}h`,
+		daily: (t: string) => `Daily, ${t}`,
+		onDays: (ds: number[], t: string) => {
+			if (ds.join() === '1,2,3,4,5') return `Weekdays, ${t}`
+			if (ds.join() === '0,6') return `Weekends, ${t}`
+			if (ds.length === 1) return `${DAY_NAMES[ds[0]]}s, ${t}`
+			return `${ds.map((d) => DAY_NAMES[d].slice(0, 3)).join('/')}, ${t}`
+		},
+		monthly: (day: string, t: string) => `Monthly on the ${day}, ${t}`
+	}
 }
 
 /**
- * A short plain-English reading of a Windmill cron expression — "Hourly",
- * "Daily, 4:00", "Mondays, 9:30" — or undefined when it is not one
- * of the common shapes, so the caller can show the expression itself.
+ * A plain-English reading of a Windmill cron expression — "Every hour",
+ * "Every day at 4:00", "Every Monday at 9:30" (or, compact, "Hourly", "Daily, 4:00",
+ * "Mondays, 9:30") — or undefined when it is not one of the common shapes, so the
+ * caller can show the expression itself.
  *
  * Windmill crons have six fields, seconds first; a five-field entry is padded
  * at the end the way the schedule editor saves it (`formatCron`).
  */
-export function describeCron(cron: string): string | undefined {
+export function describeCron(
+	cron: string,
+	{ compact = false }: CronDescriptionOptions = {}
+): string | undefined {
+	const w = compact ? WORDS.compact : WORDS.sentence
 	const fields = formatCron(cron.trim()).split(/\s+/)
 	if (fields.length !== 6) return undefined
 	const [sec, min, hour, dom, month, dow] = fields
@@ -75,7 +117,7 @@ export function describeCron(cron: string): string | undefined {
 	if (anyDay && min === '*' && hour === '*') {
 		if (sec === '*') return 'Every second'
 		const n = everyN(sec)
-		if (n) return `Every ${n}s`
+		if (n) return w.everySeconds(n)
 	}
 	if (sec !== '0') return undefined
 
@@ -83,24 +125,24 @@ export function describeCron(cron: string): string | undefined {
 		if (hour === '*') {
 			if (min === '*') return 'Every minute'
 			const n = everyN(min)
-			if (n) return `Every ${n} min`
-			if (min === '0') return 'Hourly'
-			if (isNum(min)) return `Hourly at :${min.padStart(2, '0')}`
+			if (n) return w.everyMinutes(n)
+			if (min === '0') return w.hourly
+			if (isNum(min)) return w.hourlyAt(min.padStart(2, '0'))
 			return undefined
 		}
 		const n = everyN(hour)
-		if (n && min === '0') return `Every ${n}h`
-		if (isNum(hour) && isNum(min)) return `Daily, ${time(hour, min)}`
+		if (n && min === '0') return w.everyHours(n)
+		if (isNum(hour) && isNum(min)) return w.daily(time(hour, min))
 		return undefined
 	}
 
 	if (!isNum(hour) || !isNum(min)) return undefined
 	if (dom === '*') {
 		const ds = days(dow)
-		return ds ? `${listDays(ds)}, ${time(hour, min)}` : undefined
+		return ds ? w.onDays(ds, time(hour, min)) : undefined
 	}
 	if (isNum(dom) && (dow === '*' || dow === '?')) {
-		return `Monthly on the ${ordinal(Number(dom))}, ${time(hour, min)}`
+		return w.monthly(ordinal(Number(dom)), time(hour, min))
 	}
 	return undefined
 }
@@ -118,9 +160,13 @@ function shortZone(timezone: string): string {
 }
 
 /** `describeCron` of a schedule, naming its zone whenever the text ends on a
- * wall-clock time: "Daily, 12:00 UTC". */
-export function describeSchedule(cron: string, timezone?: string): string | undefined {
-	const text = describeCron(cron)
+ * wall-clock time: "Every day at 12:00 UTC", "Daily, 12:00 UTC". */
+export function describeSchedule(
+	cron: string,
+	timezone?: string,
+	options?: CronDescriptionOptions
+): string | undefined {
+	const text = describeCron(cron, options)
 	if (!text || !timezone || !/\d:\d\d$/.test(text)) return text
 	return `${text} ${shortZone(timezone)}`
 }
diff --git a/frontend/src/lib/utils/editInFork.ts b/frontend/src/lib/utils/editInFork.ts
index ad2b700c9a..67eebcf7eb 100644
--- a/frontend/src/lib/utils/editInFork.ts
+++ b/frontend/src/lib/utils/editInFork.ts
@@ -17,21 +17,19 @@ import { updateDevWorkspaceModal } from '$lib/utils/editInForkModal.svelte'
 export type ItemType = 'script' | 'flow' | 'app' | 'raw_app'
 
 /**
- * Whether to show the "edit in fork / dev workspace" affordance. Allowed when forking isn't disabled,
- * when the user can bypass the forking rule (workspace admins, mirroring `canCreateFork`), OR when the
- * current workspace has a canonical dev to route to — routing into an existing dev workspace creates
- * no fork, so it survives a locked prod that has `DisableWorkspaceForking` set. User identity is read
+ * Whether to show the "edit in fork / dev workspace" affordance. Allowed when the user may create a
+ * fork, OR when the current workspace has a canonical dev to route to — routing into an existing dev
+ * workspace creates no fork, so it survives a locked prod that has `DisableWorkspaceForking` set.
+ * Never for an operator, who has nothing to edit at the other end either way. User identity is read
  * non-reactively (it's stable within a session); reactivity comes from the workspace args.
  */
 export function editInForkAllowed(
 	currentWorkspaceId: string | undefined,
 	allWorkspaces: UserWorkspace[]
 ): boolean {
-	return (
-		!isRuleActive('DisableWorkspaceForking') ||
-		canUserBypassRuleKind('DisableWorkspaceForking', get(userStore)) ||
-		!!findCanonicalDevWorkspace(currentWorkspaceId, allWorkspaces)
-	)
+	const user = get(userStore)
+	if (user?.operator) return false
+	return canCreateFork(user) || !!findCanonicalDevWorkspace(currentWorkspaceId, allWorkspaces)
 }
 
 /** Label for the affordance: "Edit in <dev name>" when routed to a canonical dev, else "Edit in fork". */
@@ -57,11 +55,17 @@ export function editInForkDescription(
 }
 
 /**
- * Whether the user may CREATE a new fork of the current workspace: forking not disabled, or the user
- * can bypass the rule (workspace admins). Keeps the "Fork workspace" entry available to admins as the
- * last-resort escape hatch on a locked prod.
+ * Whether the user may CREATE a new fork of the current workspace: not an operator, and either
+ * forking isn't disabled or they can bypass the rule (workspace admins). Keeps the "Fork workspace"
+ * entry available to admins as the last-resort escape hatch on a locked prod.
+ *
+ * An operator is refused because a fork does not carry the role: the server writes the forker's
+ * membership row from the parent's `is_admin` and lets `operator` fall to its `false` default, so
+ * forking would hand an operator a full-rights copy of the workspace. The server does not refuse it
+ * — this hides the affordance, it does not enforce the rule.
  */
 export function canCreateFork(user: UserExt | undefined): boolean {
+	if (user?.operator) return false
 	return (
 		!isRuleActive('DisableWorkspaceForking') ||
 		canUserBypassRuleKind('DisableWorkspaceForking', user)
diff --git a/frontend/src/lib/utils/forkColor.ts b/frontend/src/lib/utils/forkColor.ts
index 232acbbe90..5839bb13de 100644
--- a/frontend/src/lib/utils/forkColor.ts
+++ b/frontend/src/lib/utils/forkColor.ts
@@ -2,6 +2,17 @@
 // blue's light/dark bg+text profile, re-hued. Lightness is fixed per role so
 // any picked hue stays readable; saturation follows the user color within a
 // safe band so grayish picks yield grayish chips.
+//
+// The badge filled with the hue is the exception, because white is written on
+// it and a fixed lightness cannot carry white across the wheel: HSL lightness
+// is not perceived brightness, so a yellow and a purple at the same L differ by
+// several stops of luminance. Its lightness is solved instead — the lightest
+// shade of the hue that still holds white at WCAG AA.
+
+/** WCAG AA for small text: the badge's own label is what is being read. */
+const TEXT_MIN_CONTRAST = 4.5
+/** White, which the badge's label is written in. */
+const WHITE_LUMINANCE = 1
 
 function hexToHsl(hex: string): { h: number; s: number; l: number } | undefined {
 	const m = /^#?([0-9a-f]{3}|[0-9a-f]{6})$/i.exec(hex.trim())
@@ -32,12 +43,84 @@ function hsl(h: number, s: number, l: number): string {
 	return `hsl(${Math.round(h)}, ${Math.round(s * 100)}%, ${Math.round(l * 100)}%)`
 }
 
+/** The same string with lightness floored: a solved lightness is the lightest value that clears
+ *  its contrast target, so rounding the whole percent up would spend the margin just bought. */
+function hslFloorL(h: number, s: number, l: number): string {
+	return `hsl(${Math.round(h)}, ${Math.round(s * 100)}%, ${Math.floor(l * 100)}%)`
+}
+
+function hslToRgb(h: number, s: number, l: number): [number, number, number] {
+	const c = (1 - Math.abs(2 * l - 1)) * s
+	const hp = (((h % 360) + 360) % 360) / 60
+	const x = c * (1 - Math.abs((hp % 2) - 1))
+	const [r, g, b] =
+		hp < 1
+			? [c, x, 0]
+			: hp < 2
+				? [x, c, 0]
+				: hp < 3
+					? [0, c, x]
+					: hp < 4
+						? [0, x, c]
+						: hp < 5
+							? [x, 0, c]
+							: [c, 0, x]
+	const m = l - c / 2
+	return [r + m, g + m, b + m]
+}
+
+function relativeLuminance(r: number, g: number, b: number): number {
+	const f = (x: number) => (x <= 0.03928 ? x / 12.92 : ((x + 0.055) / 1.055) ** 2.4)
+	return 0.2126 * f(r) + 0.7152 * f(g) + 0.0722 * f(b)
+}
+
+function contrast(a: number, b: number): number {
+	return (Math.max(a, b) + 0.05) / (Math.min(a, b) + 0.05)
+}
+
+/** Luminance of what the browser paints, which is neither the exact numbers nor the `hsl()` string
+ *  alone: the string carries whole percents, and the channels it resolves to are 8-bit. Solving
+ *  against the unrounded channels leaves the chosen lightness up to 0.025 short of the target once
+ *  painted, which is enough to miss AA on a hue like #993388. */
+function paintedLuminance(h: number, s: number, l: number): number {
+	const [r, g, b] = hslToRgb(Math.round(h), Math.round(s * 100) / 100, Math.floor(l * 100) / 100)
+	const q = (x: number) => Math.round(x * 255) / 255
+	return relativeLuminance(q(r), q(g), q(b))
+}
+
 /**
- * Inline-style string setting the four `--fork-accent-*` custom properties a
- * colored fork chip consumes (see WorkspaceScopeTrigger). Returns undefined
- * for an unparsable color, letting the chip fall back to the default accent.
+ * The lightest L in [0, hi] whose color contrasts at least `target` against `against`. Luminance
+ * rises with L at a fixed hue and saturation, so the predicate flips once and a bisection finds
+ * the edge; 12 steps put it within 0.03 of a percent, finer than the whole percent the string
+ * carries.
  */
-export function forkAccentStyle(color: string | undefined): string | undefined {
+function lightestAtContrast(
+	h: number,
+	s: number,
+	hi: number,
+	against: number,
+	target: number
+): number {
+	let lo = 0
+	let best = 0
+	for (let i = 0; i < 12; i++) {
+		const mid = (lo + hi) / 2
+		if (contrast(paintedLuminance(h, s, mid), against) >= target) {
+			best = mid
+			lo = mid
+		} else {
+			hi = mid
+		}
+	}
+	return best
+}
+
+/**
+ * Inline-style string setting the `--fork-accent-*` custom properties a colored
+ * fork chip consumes (see WorkspaceScopeTrigger). Returns undefined for an
+ * unparsable color, letting the chip fall back to the default accent.
+ */
+export function forkAccentStyle(color: string | null | undefined): string | undefined {
 	if (!color) return undefined
 	const parsed = hexToHsl(color)
 	if (!parsed) return undefined
@@ -46,5 +129,14 @@ export function forkAccentStyle(color: string | undefined): string | undefined {
 	const lightText = hsl(h, clamp(s, 0.3, 0.8), 0.42)
 	const darkBg = hsl(h, clamp(s * 0.35, 0.08, 0.25), 0.26)
 	const darkText = hsl(h, clamp(s, 0.3, 0.9), 0.86)
-	return `--fork-accent-bg: ${lightBg}; --fork-accent-text: ${lightText}; --fork-accent-bg-dark: ${darkBg}; --fork-accent-text-dark: ${darkText};`
+	// The filled badge inside the chip: the hue at near-full strength, as light as it can be while
+	// white still reads on it. Same in both themes — it is the one thing on the line that is a
+	// block of color rather than a tint, so it needs no second version.
+	const badgeSat = clamp(s, 0.35, 0.9)
+	const badge = hslFloorL(
+		h,
+		badgeSat,
+		lightestAtContrast(h, badgeSat, 0.7, WHITE_LUMINANCE, TEXT_MIN_CONTRAST)
+	)
+	return `--fork-accent-bg: ${lightBg}; --fork-accent-text: ${lightText}; --fork-accent-badge: ${badge}; --fork-accent-bg-dark: ${darkBg}; --fork-accent-text-dark: ${darkText};`
 }
diff --git a/frontend/src/lib/utils/queryParams.ts b/frontend/src/lib/utils/queryParams.ts
new file mode 100644
index 0000000000..ffefc47eea
--- /dev/null
+++ b/frontend/src/lib/utils/queryParams.ts
@@ -0,0 +1,22 @@
+// Query params Windmill consumes internally and that should not be exposed to
+// app logic via the `query` context. Only params we actually own are listed
+// here — the `wm_` prefix is a naming convention, not a reserved namespace, so
+// we don't strip it wholesale (that would break apps reading their own `wm_*`
+// params). `wm_coep` is a transport flag for cross-origin isolation headers;
+// `wm_embed`/`wm_embedder_origin` are the opaque app viewer transport params
+// (see PublicAppFrame).
+export const WINDMILL_RESERVED_QUERY_PARAMS = new Set(['wm_coep', 'wm_embed', 'wm_embedder_origin'])
+
+export function urlParamsToObject(
+	params: URLSearchParams,
+	opts?: { stripReserved?: boolean }
+): Record<string, string> {
+	const result: Record<string, string> = {}
+	params.forEach((value, key) => {
+		if (opts?.stripReserved && WINDMILL_RESERVED_QUERY_PARAMS.has(key)) {
+			return
+		}
+		result[key] = value
+	})
+	return result
+}
diff --git a/frontend/src/lib/utils_deployable.ts b/frontend/src/lib/utils_deployable.ts
index 63ea88adcb..e3f7fa83ed 100644
--- a/frontend/src/lib/utils_deployable.ts
+++ b/frontend/src/lib/utils_deployable.ts
@@ -16,7 +16,7 @@ import {
 	type WorkspaceDeployUISettings
 } from './gen'
 import type { TriggerKind } from './components/triggers'
-import { base } from './base'
+import { apiBaseUrl } from './apiBaseUrl.svelte'
 
 type DeployUIType = 'script' | 'flow' | 'app' | 'resource' | 'variable' | 'secret' | 'trigger'
 
@@ -250,9 +250,7 @@ export async function getTriggersDeployData(
 			...gcpTrigger,
 			delivery_config: gcpTrigger.delivery_config ?? undefined,
 			base_endpoint:
-				gcpTrigger.delivery_type === 'push'
-					? (targetBaseUrl ?? `${window.location.origin}${base}`)
-					: undefined,
+				gcpTrigger.delivery_type === 'push' ? (targetBaseUrl ?? apiBaseUrl()) : undefined,
 			permissioned_as: onBehalfOf,
 			preserve_permissioned_as: preservePermissionedAs
 		}
@@ -320,7 +318,7 @@ export async function getTriggersDeployData(
 				base_endpoint:
 					azureTrigger.azure_mode === 'namespace_pull'
 						? undefined
-						: (targetBaseUrl ?? `${window.location.origin}${base}`),
+						: (targetBaseUrl ?? apiBaseUrl()),
 				permissioned_as: onBehalfOf,
 				preserve_permissioned_as: preservePermissionedAs
 			},
diff --git a/frontend/src/lib/utils_workspace_deploy.ts b/frontend/src/lib/utils_workspace_deploy.ts
index ba1f293678..fa50805e3a 100644
--- a/frontend/src/lib/utils_workspace_deploy.ts
+++ b/frontend/src/lib/utils_workspace_deploy.ts
@@ -314,7 +314,7 @@ function makeProvider(
 		existsTriggerByKind: (kind, p) => triggerServiceFor(kind).exists(p),
 		getTriggerForDeploy: async (kind, p) => {
 			// Reuses the existing per-kind transform map (e.g. GCP wipes
-			// subscription_id and computes base_endpoint from window.location).
+			// subscription_id and computes base_endpoint for this instance).
 			// Operational-state strip is applied by the shared `deployItem`
 			// after this returns.
 			const { data } = await getTriggersDeployData(
@@ -779,7 +779,8 @@ const KIND_GATED_BY_DEPLOY_RULES: Record<Kind, boolean> = {
 	email_trigger: false,
 	datatable_migration: false,
 	trigger: false,
-	data_pipeline: false
+	// Deploying a pipeline deploys its scripts.
+	data_pipeline: true
 }
 
 // Every gated kind is spelled identically in `Kind` and `UserDraftItemKind`, so one lookup serves
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index 1d4bc9de19..2403299e71 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -12,10 +12,13 @@
 		UserService,
 		WorkspaceService
 	} from '$lib/gen'
-	import { capitalize, classNames, getModifierKey, sendUserToast } from '$lib/utils'
+	import { capitalize, classNames, debounce, getModifierKey, sendUserToast } from '$lib/utils'
 	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
-	import { isSessionPreviewFrame } from '$lib/components/sessions/sessionMode.svelte'
-	import WorkspaceMenu from '$lib/components/sidebar/WorkspaceMenu.svelte'
+	import {
+		isMenuHidden,
+		isSessionPreviewFrame,
+		rememberMenuHidden
+	} from '$lib/components/sessions/sessionMode.svelte'
 	import SidebarContent from '$lib/components/sidebar/SidebarContent.svelte'
 	import SettingsMenu from '$lib/components/sidebar/SettingsMenu.svelte'
 	import SidebarUsage from '$lib/components/sidebar/SidebarUsage.svelte'
@@ -65,17 +68,27 @@
 		getFavoriteHref,
 		getFavoriteLabel
 	} from '$lib/components/sidebar/FavoriteMenu.svelte'
-	import {
-		parseSuperadminSettingsHash,
-		USER_SETTINGS_HASH
-	} from '$lib/components/sidebar/settings'
+	import { parseSuperadminSettingsHash, USER_SETTINGS_HASH } from '$lib/components/sidebar/settings'
 	import { isCloudHosted } from '$lib/cloud'
-	import { PanelLeftClose, PanelLeftOpen, Home, Play, Search, WandSparkles } from 'lucide-svelte'
+	import {
+		PanelLeft,
+		PanelLeftClose,
+		PanelLeftDashed,
+		PanelLeftOpen,
+		Home,
+		Play,
+		Search,
+		WandSparkles
+	} from 'lucide-svelte'
 	import { getUserExt } from '$lib/user'
 	import { confirmPendingLoginMethod } from '$lib/lastLoginMethod'
 	import { deepEqual } from 'fast-equals'
 	import { twMerge } from 'tailwind-merge'
-	import OperatorMenu from '$lib/components/sidebar/OperatorMenu.svelte'
+	import { navDetached } from '$lib/components/sidebar/navDetached.svelte'
+	import { navHandleSlot } from '$lib/components/sidebar/navHandlePlacement.svelte'
+	import PageHeaderBar from '$lib/components/PageHeaderBar.svelte'
+	import { BAR_HEIGHT_PX, pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
+	import { sidebarPageAllowed } from '$lib/components/sidebar/operatorRoutes'
 	import type GlobalSearchModal from '$lib/components/search/GlobalSearchModal.svelte'
 	import MenuButton from '$lib/components/sidebar/MenuButton.svelte'
 	import MenuLink from '$lib/components/sidebar/MenuLink.svelte'
@@ -88,8 +101,9 @@
 	import InstanceBanner from '$lib/components/InstanceBanner.svelte'
 	import InstanceUiSync from '$lib/components/InstanceUiSync.svelte'
 	import { onDestroy, setContext, untrack } from 'svelte'
+	import { cubicOut } from 'svelte/easing'
 	import { base } from '$app/paths'
-	import { Menubar } from '$lib/components/meltComponents'
+	import { Menubar, Tooltip } from '$lib/components/meltComponents'
 	import { aiChatManager } from '$lib/components/copilot/chat/AIChatManager.svelte'
 	import AiChatLayout from '$lib/components/copilot/chat/AiChatLayout.svelte'
 	import SessionPicker from '$lib/components/sessions/SessionPicker.svelte'
@@ -105,7 +119,6 @@
 	import { sessionState } from '$lib/components/sessions/sessionState.svelte'
 	import { restoreSessionBackups } from '$lib/components/sessions/sessionMirror.svelte'
 	import { currentWorkspaceRootId } from '$lib/components/sessions/sessionScope.svelte'
-	import WorkspaceScopeHeader from '$lib/components/sidebar/WorkspaceScopeHeader.svelte'
 	import { DEFAULT_HUB_BASE_URL } from '$lib/hub'
 	import S3FilePicker from '$lib/components/S3FilePicker.svelte'
 	import { useIsDarkMode } from '$lib/components/DarkModeObserver.svelte'
@@ -143,10 +156,13 @@
 	// Persisted nav-rail collapse preference. A deliberate collapse writes to it —
 	// the manual toggle and a drag past the collapse threshold. The contextual
 	// auto-collapse (app-mode routes, narrow widths) mutates the in-memory
-	// `isCollapsed` without persisting, so it stays transient and never gets
+	// `collapsedState` without persisting, so it stays transient and never gets
 	// "stuck" collapsed across reloads.
 	const collapsePref = useLocalStorageValue<boolean>('nav_menu_collapsed', false, 'boolean')
-	let isCollapsed = $state(collapsePref.val)
+	let collapsedState = $state(collapsePref.val)
+	// Operators never get the icon-only rail: their docked sidebar is always expanded (a sidebar
+	// they want out of the way is what detaching is for).
+	let isCollapsed = $derived(collapsedState && !$userStore?.operator)
 
 	// Resizable desktop rail, sized in REM so it scales with the root font-size the
 	// same way the old `w-52`/`w-12` classes did — `:root` jumps to 18px on screens
@@ -188,6 +204,15 @@
 	let sidebarTransitionClass = $derived(
 		resizingSidebar && !sidebarSnapping ? '' : 'transition-all duration-200 ease-in-out'
 	)
+	// The band spans two edges that different things move. Its left follows the rail, so it
+	// eases with it; its right follows a splitter the page owns (a session's side panel),
+	// which tracks the pointer. Easing that one leaves the band lying over the panel it is
+	// meant to stop beside — an empty strip across that panel's own header until it catches up.
+	let bandTransitionClass = $derived(
+		resizingSidebar && !sidebarSnapping
+			? ''
+			: 'transition-[left,padding-left] duration-200 ease-in-out'
+	)
 	// Set while a drag is live so it can be torn down if the layout unmounts
 	// mid-drag (otherwise the window listeners would leak).
 	let stopSidebarResize: (() => void) | null = null
@@ -207,15 +232,25 @@
 		resizingSidebar = true
 		// Re-expanding a snap-collapsed rail restores the width it had before the drag.
 		const widthAtStart = sidebarWidth
-		const collapsedAtStart = isCollapsed
+		const collapsedAtStart = collapsedState
 		// The rail is fixed at left:0, so the pointer's clientX is the width — in px.
 		// Convert to rem (the unit the rail is sized in) via the root font-size. The
 		// rail clamps at the min like a wall, until the pointer reaches the snap zone.
 		const onMove = (ev: PointerEvent) => {
 			const x = ev.clientX / rootFontPx()
 			const collapse = x < SIDEBAR_SNAP_COLLAPSE_REM
-			if (collapse !== isCollapsed) {
-				isCollapsed = collapse
+			// Operators have no icon-only rail to snap to, so the same gesture detaches
+			// instead: dragging the sidebar off the left edge puts it behind the handle.
+			// Detaching is not a resize, so the width the drag started from is what gets
+			// persisted — re-attaching restores the sidebar at the size it had.
+			if (collapse && $userStore?.operator) {
+				sidebarWidth = widthAtStart
+				stop()
+				setDetached(true)
+				return
+			}
+			if (collapse !== collapsedState) {
+				collapsedState = collapse
 				sidebarSnapping = true
 				clearTimeout(sidebarSnapTimer)
 				sidebarSnapTimer = setTimeout(() => (sidebarSnapping = false), 200)
@@ -231,7 +266,7 @@
 			clearTimeout(sidebarSnapTimer)
 			sidebarSnapping = false
 			widthPref.val = sidebarWidth
-			if (isCollapsed !== collapsedAtStart) collapsePref.val = isCollapsed
+			if (collapsedState !== collapsedAtStart) collapsePref.val = collapsedState
 			window.removeEventListener('pointermove', onMove)
 			window.removeEventListener('pointerup', stop)
 			window.removeEventListener('pointercancel', stop)
@@ -265,7 +300,11 @@
 	// Session mode is route-derived: the rail shows the sessions sidebar on the
 	// /sessions page and the workspace navigation everywhere else. The switch
 	// (SessionModeSwitch) just navigates in and out of that route.
-	let sessionMode = $derived(page.url.pathname.startsWith(base + '/sessions'))
+	// The route decides, except for an operator: /sessions refuses them, so handing their
+	// sidebar over to a session list would offer what the page behind it is declining.
+	let sessionMode = $derived(
+		page.url.pathname.startsWith(base + '/sessions') && !$userStore?.operator
+	)
 	// Session mode points the bottom settings entry at the open session's own
 	// workspace. An unsent draft hasn't committed one yet, so it falls back to
 	// the family root.
@@ -286,8 +325,14 @@
 	const globalAiEnabled = isGlobalAiEnabled()
 	// A workspace that hid the assistant (`ai_config.copilot_disabled`) loses both entry
 	// points: the Workspace ⇄ Sessions switch and the legacy Ask-AI button.
-	const sessionsSwitchShown = $derived(globalAiEnabled && !$copilotInfo.workspaceDisabled)
-	const askAiShown = $derived(!globalAiEnabled && !$copilotInfo.workspaceDisabled)
+	const sessionsSwitchShown = $derived(
+		globalAiEnabled && !$copilotInfo.workspaceDisabled && !$userStore?.operator
+	)
+	// The legacy pane's entry point. An operator keeps that pane whatever the beta gate says
+	// (`disableAi` above), so the sidebar must still offer them a way into it.
+	const askAiShown = $derived(
+		(!globalAiEnabled || $userStore?.operator) && !$copilotInfo.workspaceDisabled
+	)
 
 	if (page.status == 404) {
 		goto('/user/login')
@@ -314,27 +359,10 @@
 			$workspaceStore = queryWorkspace
 		}
 
-		// When this window is an iframe (e.g. the sessions preview), keep the menu
-		// hidden once `nomenubar` has been requested: navigating inside the preview
-		// drops the query param (both client-side routing and full-document loads),
-		// and we don't want the global nav to pop back in. Stickiness is stored in
-		// sessionStorage so it survives full reloads within the iframe's browsing
-		// context. The top window is unaffected (embedded is false there), so the
-		// oauth-callback case and ordinary navigation still toggle normally.
-		const embedded = typeof window !== 'undefined' && window.self !== window.top
-		const requested = page.url.searchParams.get('nomenubar') === 'true'
-		if (embedded && requested) {
-			try {
-				sessionStorage.setItem('nomenubar_embedded', 'true')
-			} catch {}
-		}
-		let stickyEmbedded = false
-		if (embedded) {
-			try {
-				stickyEmbedded = sessionStorage.getItem('nomenubar_embedded') === 'true'
-			} catch {}
-		}
-		menuHidden = requested || page.url.pathname.startsWith('/oauth/callback/') || stickyEmbedded
+		// Pages read the same rule (a page whose only control lives in the band has to carry it
+		// itself where there is no band), so it is defined once in sessionMode.
+		rememberMenuHidden(page.url)
+		menuHidden = isMenuHidden(page.url)
 	}
 
 	async function updateUserStore(workspace: string | undefined) {
@@ -471,6 +499,79 @@
 	})
 
 	let innerWidth = $state(BROWSER ? window.innerWidth : 2000)
+	// The sidebar leaves the layout and becomes a card under the band's handle when it is
+	// detached, and below 768px, where a 13rem rail would take a third of the screen. One
+	// presentation for both: a phone gets the card the handle already opens, not a modal.
+	let useDrawer = $derived(innerWidth < 768 || navDetached.val)
+	// Hover opened the card, so the pointer leaving closes it — where there is a pointer to
+	// leave. A tap opened it on a touch screen, and it stays until it is dismissed.
+	const hoverPointer = BROWSER && window.matchMedia('(hover: hover)').matches
+	const peeksOnHover = $derived(useDrawer && hoverPointer)
+	// The peek card is a hover affordance, so it goes away when the pointer does — off the handle
+	// and off the card both. The delay is what lets the pointer cross the gap between them: they
+	// do not touch, and the leave of the one fires before the enter of the other.
+	const PEEK_CLOSE_DELAY_MS = 200
+	// Both the card and the band open menus, and a menu portals to `body` (overlayPortalTarget),
+	// so the pointer moving into one leaves the surface that opened it. A surface has to outlive
+	// its own menus or it slides out from under the one being read: hold while the pointer is in a
+	// menu, and take the close from the leave of that instead.
+	function pointerInMenu(): boolean {
+		return !!document.querySelector('[role="menu"]:hover')
+	}
+	const { debounced: schedulePeekClose, clearDebounce: cancelPeekClose } = debounce(() => {
+		if (!peeksOnHover) return
+		if (pointerInMenu()) {
+			schedulePeekClose()
+			return
+		}
+		menuOpen = false
+	}, PEEK_CLOSE_DELAY_MS)
+
+	// A page that owns the right edge from the top — a session's side panel — makes the band float
+	// and stop where that column starts, instead of running over it.
+	const floatBand = $derived(pageHeader.content?.barRightInset != null)
+
+	// The handle and the edge band both open the card this layout owns.
+	navHandleSlot.setOpener(() => (menuOpen = true), {
+		schedule: schedulePeekClose,
+		cancel: cancelPeekClose
+	})
+
+	// Set once the user docks or detaches, so the rail that mounts from then on skips its
+	// app-entry animation (`wm-sidebar-in`) and only plays `railMorph`.
+	let dockToggled = $state(false)
+	function setDetached(detached: boolean) {
+		dockToggled = true
+		menuOpen = false
+		navDetached.val = detached
+	}
+	// Docking and detaching move and resize the rail itself between its docked box and the detached
+	// card's (top at the band's bottom edge, bottom and left insets, rounded corners); detaching
+	// also slides it off the left edge, where the closed card lives. No opacity: the rail never
+	// fades.
+	// The footer's icon buttons wear the rail's own row box — 32px square, 16px glyph — so the
+	// pair that hides and collapses the sidebar lines up with the links above them, collapsed or
+	// not. Padding alone drifted: two different paddings, two icon sizes and a negative margin.
+	const SIDEBAR_ICON_BUTTON =
+		'h-8 w-8 flex items-center justify-center rounded hover:bg-surface-hover flex-shrink-0'
+
+	const RAIL_MORPH_MS = 200
+	function railMorph(_node: HTMLElement, { offscreen }: { offscreen: boolean }) {
+		const reduced = window.matchMedia('(prefers-reduced-motion: reduce)').matches
+		// The card is always the default width; a rail the user widened resizes to or from it.
+		const docked = railWidth
+		return {
+			duration: reduced ? 0 : RAIL_MORPH_MS,
+			easing: cubicOut,
+			css: (t: number, u: number) =>
+				`top:${u * BAR_HEIGHT_PX}px; bottom:${u * 8}px; left:${u * 4}px; border-radius:${u * 8}px; overflow:hidden;` +
+				`width:${SIDEBAR_MIN_REM + (docked - SIDEBAR_MIN_REM) * t}rem;` +
+				(offscreen ? `transform:translateX(calc(${-u} * (100% + 0.5rem)));` : '')
+		}
+	}
+	// Matches the edge band's `duration-200`, so the drawer opens as the tint finishes.
+	const EDGE_OPEN_DELAY_MS = 200
+	let edgeOpenTimer: ReturnType<typeof setTimeout> | undefined
 
 	function onLoad() {
 		loadFavorites()
@@ -626,9 +727,13 @@
 		}
 	})
 
+	// Narrow enough that the rail is in the way: collapse it, transiently (see `collapsedState`).
+	// The drawer widths below 768 are included — there the sidebar is a modal panel over the page,
+	// and a window that has been that narrow should come back to the icon rail rather than to a
+	// 13rem one it no longer has room for.
 	function changeCollapsed() {
-		if (innerWidth < 1248 && innerWidth >= 768 && !isCollapsed) {
-			isCollapsed = true
+		if (innerWidth < 1248 && !collapsedState) {
+			collapsedState = true
 		}
 	}
 
@@ -745,7 +850,7 @@
 			// Its last month runs on a cap too, but nothing is unpaid: only speak up once it bites
 			if ((premiumInfo.usage ?? 0) > (premiumInfo.max_tolerated_executions ?? 0)) {
 				sendUserToast(
-					'Your team plan was canceled and this month\'s paid executions are used up. Jobs can run again on the free plan from the 1st, or subscribe again in the workspace settings.',
+					"Your team plan was canceled and this month's paid executions are used up. Jobs can run again on the free plan from the 1st, or subscribe again in the workspace settings.",
 					true
 				)
 			}
@@ -892,11 +997,6 @@
 	$effect(() => {
 		$workspaceStore && $userStore && untrack(() => loadDefaultScripts($workspaceStore!, $userStore))
 	})
-	$effect(() => {
-		if (isCollapsed && $userStore?.operator) {
-			isCollapsed = false
-		}
-	})
 	$effect(() => {
 		if (
 			$enterpriseLicense &&
@@ -965,6 +1065,11 @@
 		label="Runs"
 		href={`${base}/runs`}
 		icon={Play}
+		disabled={!sidebarPageAllowed(
+			$userStore?.operator,
+			$userWorkspaces?.find((w) => w.id === $workspaceStore),
+			'runs'
+		)}
 		isCollapsed={collapsed}
 		aiId="sidebar-menu-link-runs"
 		aiDescription="Button to navigate to runs"
@@ -990,6 +1095,30 @@
 
 <!-- Windmill brand mark anchoring the sidebar bottom (the header slot is taken
      by the workspace picker). -->
+<!-- Detaching is the operator's control: they have no icon-only rail to collapse to, so hiding the
+     sidebar is how they give the page its width back. A developer collapses instead, and never
+     detaches — but one who detached before this was so keeps the way back, or they would be stuck
+     with a sidebar they cannot return. -->
+{#snippet sidebarToggle()}
+	{@const hidden = navDetached.val}
+	{#if hidden || $userStore?.operator}
+		<Tooltip class="flex" placement="bottom" small>
+			<button
+				class={SIDEBAR_ICON_BUTTON}
+				aria-label={hidden ? 'Show sidebar' : 'Hide sidebar'}
+				onclick={() => setDetached(!hidden)}
+			>
+				{#if hidden}
+					<PanelLeft size={16} class="flex-shrink-0 text-hint" />
+				{:else}
+					<PanelLeftDashed size={16} class="flex-shrink-0 text-hint" />
+				{/if}
+			</button>
+			{#snippet text()}{hidden ? 'Show sidebar' : 'Hide sidebar'}{/snippet}
+		</Tooltip>
+	{/if}
+{/snippet}
+
 {#snippet brandMark(collapsed: boolean)}
 	<div class="flex items-center gap-x-1.5 text-xs font-semibold text-emphasis">
 		<WindmillIcon white={darkMode} height="16px" width="16px" />
@@ -1014,6 +1143,164 @@
 	</div>
 {/snippet}
 
+<!-- The sidebar's one column, rendered in whichever shell the width calls for: the rail docked
+     at the left edge, or the same column as a panel over the page (`panel`) below 768px and
+     whenever the nav is detached. The shells differ, the sections do not, so a change to the
+     rail cannot miss the panel. -->
+{#snippet sidebarColumn(panel: boolean)}
+	{@const collapsed = panel ? false : isCollapsed}
+	<div
+		class={twMerge(
+			'flex flex-col',
+			panel
+				? 'h-full w-52'
+				: 'flex-1 min-h-0 shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))] dark:shadow-[inset_-1px_0_0_0_#374151] [html.github-dark_&]:shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))]'
+		)}
+		style:background-color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}
+	>
+		{#if !panel}
+			<!-- Resize handle straddling the right edge: drag to resize, into the
+			     left snap zone to collapse, or out of it to expand. -->
+			<div
+				role="separator"
+				aria-orientation="vertical"
+				aria-label="Resize sidebar"
+				title="Drag to resize"
+				class={classNames(
+					'absolute inset-y-0 -right-0.5 w-1.5 cursor-col-resize z-50 transition-colors',
+					resizingSidebar ? '' : 'hover:bg-surface-hover'
+				)}
+				onpointerdown={startSidebarResize}
+			></div>
+		{/if}
+		<!-- Top row: the workspace ⇄ sessions switch, level with the page header's own
+		     row so the two read as one band. The workspace picker itself lives in that
+		     header, which is why nothing names the workspace here. -->
+		{#if !embedded && sessionsSwitchShown}
+			<div
+				class="flex-shrink-0 px-2 gap-1 flex {collapsed
+					? 'flex-col items-center py-2'
+					: 'h-12 items-center'}"
+			>
+				<div class="min-w-0 flex-1">
+					<SessionModeSwitch
+						mode={sessionMode ? 'session' : 'nav'}
+						isCollapsed={collapsed}
+						onToggle={panel ? () => (preserveMenuOnNextNav = true) : undefined}
+					/>
+				</div>
+			</div>
+		{/if}
+
+		{#if sessionMode}
+			<!-- Session mode: the session list owns the column. Workspace nav moves
+			     into the preview side panel (the iframe renders its own nav). -->
+			<div class="px-2 py-2 flex flex-col gap-1 flex-1 min-h-0 overflow-y-auto">
+				<SessionPicker isCollapsed={collapsed} embedded collapsible={false} />
+			</div>
+			{@render settingsMenu(collapsed)}
+		{:else}
+			<!-- Navigation mode: Home → Settings scroll as ONE block with an
+			     overflow fade hint. The three sections (Home/Runs + Favorites +
+			     Search / workspace items / instance settings) are spaced by the
+			     scroll area's gap rather than each scrolling on its own. -->
+			<SidebarScrollArea color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}>
+				<!-- Section 1: Home/Runs + Favorites + Search -->
+				<div class="px-2 pt-1 flex flex-col gap-1">
+					{@render quickLinks(collapsed)}
+					<Menubar class="flex flex-col gap-1">
+						{#snippet children({ createMenu })}
+							<FavoriteMenu
+								{createMenu}
+								favoriteLinks={favoriteManager.current}
+								isCollapsed={collapsed}
+							/>
+						{/snippet}
+					</Menubar>
+					<MenuButton
+						stopPropagationOnClick={true}
+						on:click={() => openSearchModal()}
+						isCollapsed={collapsed}
+						icon={Search}
+						label="Search"
+						class="!text-xs"
+						shortcut={`${getModifierKey()}k`}
+					/>
+					{#if askAiShown}
+						<!-- Legacy Ask-AI pane, shown only when the user opted out of the
+						     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
+						<MenuButton
+							stopPropagationOnClick={true}
+							on:click={() => aiChatManager.toggleOpen()}
+							isCollapsed={collapsed}
+							icon={WandSparkles}
+							iconProps={{ forceDarkMode: true }}
+							label="Ask AI"
+							class="!text-xs"
+							iconClasses="!text-ai"
+							shortcut={`${getModifierKey()}L`}
+						/>
+					{/if}
+				</div>
+
+				<!-- Section 2: workspace items -->
+				<SidebarContent
+					isCollapsed={collapsed}
+					showSecondary={false}
+					excludeMainLabels={['Home', 'Runs']}
+					numUnacknowledgedCriticalAlerts={isCriticalAlertsUiMuted
+						? 0
+						: numUnacknowledgedCriticalAlerts}
+				/>
+
+				<!-- Section 3: instance settings — mt-auto drops it to the bottom
+				     when the column has spare room, and collapses back to the normal
+				     inter-section gap once the content overflows and scrolls. -->
+				<div class="mt-auto">
+					{@render settingsMenu(collapsed)}
+				</div>
+			</SidebarScrollArea>
+		{/if}
+
+		<div class="flex-shrink-0">
+			{@render accountSetupBanner(collapsed)}
+			<SidebarUsage isCollapsed={collapsed} />
+		</div>
+
+		<div
+			class="flex-shrink-0 flex pt-3 pb-3.5 {collapsed
+				? 'flex-col items-center gap-3'
+				: 'items-center justify-between px-4'}"
+		>
+			{@render brandMark(collapsed)}
+			<div class="flex {collapsed ? 'flex-col gap-3' : 'gap-3'}">
+				{#if !panel || navDetached.val}
+					{@render sidebarToggle()}
+				{/if}
+				<!-- Collapsing belongs to the rail: the panel is over the page already, and the way
+				     out of it is the handle in the band or a click outside. -->
+				{#if !panel && !$userStore?.operator}
+					<button
+						class={SIDEBAR_ICON_BUTTON}
+						title={collapsed ? 'Expand sidebar' : 'Collapse sidebar'}
+						onclick={() => {
+							collapsedState = !collapsedState
+							// Manual toggle is the persisted preference (auto-collapse isn't).
+							collapsePref.val = collapsedState
+						}}
+					>
+						{#if collapsed}
+							<PanelLeftOpen size={16} class="flex-shrink-0 text-hint" />
+						{:else}
+							<PanelLeftClose size={16} class="flex-shrink-0 text-hint" />
+						{/if}
+					</button>
+				{/if}
+			</div>
+		</div>
+	</div>
+{/snippet}
+
 <!-- The drawers and modals below are dynamic imports mounted on first open: this layout
      wraps every workspace page, so a static import gates first paint, and a load on mount
      competes with the page for bandwidth (several of them reach monaco). -->
@@ -1053,431 +1340,112 @@
 			<div class="fixed inset-0 z-50 cursor-col-resize select-none"></div>
 		{/if}
 		{#if !menuHidden}
-			{#if !$userStore?.operator}
-				{#if innerWidth < 768}
+			{#if navDetached.val && hoverPointer && !menuOpen && !devOnly}
+				<!-- Edge band: the other way to reach a detached sidebar. It opens only once its
+				     tint has faded in, so a pointer brushing the screen edge does not open it. -->
+				<div
+					class="fixed inset-y-0 left-0 w-2 z-[4999] transition-colors duration-200 ease-out hover:bg-surface-accent-selected"
+					aria-hidden="true"
+					onmouseenter={() => {
+						clearTimeout(edgeOpenTimer)
+						edgeOpenTimer = setTimeout(() => navHandleSlot.open(), EDGE_OPEN_DELAY_MS)
+					}}
+					onmouseleave={() => {
+						clearTimeout(edgeOpenTimer)
+						schedulePeekClose()
+					}}
+				></div>
+			{/if}
+			{#if useDrawer}
+				<!-- `inert` while closed, not only `pointer-events-none`: the card stays mounted so it
+				     can slide rather than pop, and a card parked off the left edge still holds every
+				     one of its links in the tab order. -->
+				<div
+					class={classNames(
+						'relative',
+						menuOpen ? 'z-40' : 'pointer-events-none',
+						devOnly ? 'hidden' : ''
+					)}
+					inert={!menuOpen}
+					role="dialog"
+				>
+					<!-- svelte-ignore a11y_click_events_have_key_events, a11y_no_static_element_interactions -->
+					<!-- The card floats over the page, inset and rounded. Over an app it is not: the app
+					     owns the window, and the sidebar revealed beside it reads as the panel the header
+					     sits on — flush to the left and bottom edges, square, with one border down its
+					     right side. -->
+					<!-- This outside-click catcher starts where the card does rather than at the top of
+					     the viewport: it would otherwise cover the header's toggle, whose hover opened the
+					     card, and swallow the click meant to put the sidebar back. -->
 					<div
-						class={classNames(
-							'relative',
-							menuOpen ? 'z-40' : 'pointer-events-none',
-							devOnly ? 'hidden' : ''
-						)}
-						role="dialog"
-						aria-modal="true"
+						class={classNames('fixed left-0 right-0 bottom-0 flex z-40', 'pl-1 pb-2')}
+						style:top="{navHandleSlot.cardTop}px"
+						onclick={(e) => {
+							if (e.target === e.currentTarget) menuOpen = false
+						}}
 					>
+						<!-- svelte-ignore a11y_no_static_element_interactions -->
 						<div
+							data-nav-card
+							onmouseenter={() => {
+								cancelPeekClose()
+							}}
+							onmouseleave={() => {
+								schedulePeekClose()
+							}}
 							class={classNames(
-								'fixed inset-0 bg-black/50 transition-opacity ease-linear duration-300 z-40',
-
-								menuOpen ? 'opacity-100' : 'opacity-0'
+								'relative flex-1 flex flex-col max-w-min w-full bg-surface transition ease-in-out duration-300 transform shadow-lg overflow-hidden rounded-lg border',
+								menuOpen ? 'translate-x-0' : '-translate-x-[calc(100%+0.5rem)]'
 							)}
-						></div>
-
-						<div class="fixed inset-0 flex z-40">
-							<div
-								class={classNames(
-									'relative flex-1 flex flex-col max-w-min w-full bg-surface transition ease-in-out duration-300 transform',
-									menuOpen ? 'translate-x-0' : '-translate-x-full'
-								)}
-							>
-								<div
-									class={classNames(
-										'absolute top-0 right-4 -mr-12 pt-2 ease-in-out duration-300',
-										menuOpen ? 'opacity-100' : 'opacity-0'
-									)}
-								>
-									<button
-										type="button"
-										onclick={() => {
-											menuOpen = !menuOpen
-										}}
-										class="ml-1 flex items-center justify-center h-6 w-6 rounded-full focus:outline-none focus:ring-2 focus:ring-inset focus:ring-white border border-white"
-										aria-label="Close"
-									>
-										<svg
-											class="h-4 w-4 text-white"
-											xmlns="http://www.w3.org/2000/svg"
-											fill="none"
-											viewBox="0 0 24 24"
-											stroke-width="2"
-											stroke="currentColor"
-											aria-hidden="true"
-										>
-											<path
-												stroke-linecap="round"
-												stroke-linejoin="round"
-												d="M6 18L18 6M6 6l12 12"
-											/>
-										</svg>
-									</button>
-								</div>
-								<div
-									class="h-full flex flex-col"
-									style:background-color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}
-								>
-									<!-- Workspace picker as the drawer header (replaces the Windmill logo). -->
-									<div class="flex-shrink-0 px-2 h-12 w-52 flex items-center">
-										<Menubar class="w-full">
-											{#snippet children({ createMenu })}
-												<WorkspaceMenu {createMenu} />
-											{/snippet}
-										</Menubar>
-									</div>
-
-									{#if !embedded && sessionsSwitchShown}
-										<!-- The switch: workspace navigation ⇄ sessions sidebar. -->
-										<div class="px-2 pb-1 w-52">
-											<SessionModeSwitch
-												mode={sessionMode ? 'session' : 'nav'}
-												onToggle={() => (preserveMenuOnNextNav = true)}
-											/>
-										</div>
-									{/if}
-
-									{#if !sessionMode}
-										<!-- Workspace scope (fork picker): part of the top workspace group. -->
-										<div class="pb-1 w-52 {sessionsSwitchShown ? '' : '-mt-1'}">
-											<WorkspaceScopeHeader isCollapsed={false} />
-										</div>
-									{/if}
-
-									{#if sessionMode}
-										<!-- Session mode: the session list owns the rail.
-										     w-52 cap (matches the desktop sidebar width): the drawer is
-										     max-w-min, and long session titles (nowrap before truncation)
-										     would otherwise inflate its min-content width to the full
-										     text width. -->
-										<div class="px-2 py-2 w-52">
-											<SessionPicker isCollapsed={false} embedded collapsible={false} />
-										</div>
-										{@render settingsMenu(false)}
-									{:else}
-										<!-- Navigation mode: Home → Settings scroll as ONE block with an
-										     overflow fade hint (same treatment as the desktop rail). -->
-										<SidebarScrollArea color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}>
-											<!-- Section 1: Home/Runs + Favorites + Search -->
-											<div class="px-2 pt-1 w-52 flex flex-col gap-1">
-												{@render quickLinks(false)}
-												<Menubar>
-													{#snippet children({ createMenu })}
-														<FavoriteMenu {createMenu} favoriteLinks={favoriteManager.current} />
-													{/snippet}
-												</Menubar>
-												<MenuButton
-													stopPropagationOnClick={true}
-													on:click={() => openSearchModal()}
-													isCollapsed={false}
-													icon={Search}
-													label="Search"
-													class="!text-xs"
-													shortcut={`${getModifierKey()}k`}
-												/>
-												{#if askAiShown}
-													<!-- Legacy Ask-AI pane, shown only when the user opted out of the
-													     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
-													<MenuButton
-														stopPropagationOnClick={true}
-														on:click={() => aiChatManager.toggleOpen()}
-														isCollapsed={false}
-														icon={WandSparkles}
-														iconProps={{ forceDarkMode: true }}
-														label="Ask AI"
-														class="!text-xs"
-														iconClasses="!text-ai"
-														shortcut={`${getModifierKey()}L`}
-													/>
-												{/if}
-											</div>
-
-											<!-- Section 2: workspace items -->
-											<SidebarContent
-												isCollapsed={false}
-												showSecondary={false}
-												excludeMainLabels={['Home', 'Runs']}
-												numUnacknowledgedCriticalAlerts={isCriticalAlertsUiMuted
-													? 0
-													: numUnacknowledgedCriticalAlerts}
-											/>
-
-											<!-- Section 3: instance settings — mt-auto drops it to the bottom
-											     when there is spare room (see the desktop rail for the rationale). -->
-											<div class="mt-auto">
-												{@render settingsMenu(false)}
-											</div>
-										</SidebarScrollArea>
-									{/if}
-
-									<div class="w-52">
-										{@render accountSetupBanner(false)}
-										<SidebarUsage isCollapsed={false} />
-									</div>
-
-									<div class="px-4 pt-3 pb-3.5 w-52">
-										{@render brandMark(false)}
-									</div>
-								</div>
-							</div>
-						</div>
-					</div>
-				{:else}
-					<div
-						id="sidebar"
-						class={classNames(
-							'wm-sidebar-in flex flex-col fixed inset-y-0 z-40 ',
-							sidebarTransitionClass,
-							devOnly ? '!hidden' : ''
-						)}
-						style:width="{railWidth}rem"
-					>
-						<div
-							class="flex-1 flex flex-col min-h-0 h-screen shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))] dark:shadow-[inset_-1px_0_0_0_#374151] [html.github-dark_&]:shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))]"
-							style:background-color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}
 						>
-							<!-- Resize handle straddling the right edge: drag to resize, into the
-							     left snap zone to collapse, or out of it to expand. -->
-							<div
-								role="separator"
-								aria-orientation="vertical"
-								aria-label="Resize sidebar"
-								title="Drag to resize"
-								class={classNames(
-									'absolute inset-y-0 -right-0.5 w-1.5 cursor-col-resize z-50 transition-colors',
-									resizingSidebar ? '' : 'hover:bg-surface-hover'
-								)}
-								onpointerdown={startSidebarResize}
-							></div>
-							<!-- Workspace picker as the sidebar header (replaces the Windmill logo).
-							     Kept in both modes: it scopes which workspace family's sessions
-							     the sessions sidebar shows. -->
-							<div class="flex-shrink-0 px-2 h-12 flex items-center">
-								<Menubar class="w-full">
-									{#snippet children({ createMenu })}
-										<WorkspaceMenu {createMenu} {isCollapsed} />
-									{/snippet}
-								</Menubar>
-							</div>
-
-							{#if !embedded && sessionsSwitchShown}
-								<!-- The switch: workspace navigation ⇄ sessions sidebar. -->
-								<div class="px-2 pb-1 {isCollapsed ? 'flex justify-center' : ''}">
-									<SessionModeSwitch mode={sessionMode ? 'session' : 'nav'} {isCollapsed} />
-								</div>
-							{/if}
-
-							{#if !sessionMode}
-								<!-- Workspace scope (fork picker): part of the top workspace group,
-								     together with the family menu and the mode switch above. Without
-								     the switch, pull it up so the group still reads as one block. -->
-								<div class="pb-1 {sessionsSwitchShown ? '' : '-mt-1'}">
-									<WorkspaceScopeHeader {isCollapsed} />
-								</div>
-							{/if}
-
-							{#if sessionMode}
-								<!-- Session mode: the session list owns the rail. Workspace nav moves
-								     into the preview side panel (the iframe renders its own nav). -->
-								<div class="px-2 py-2 flex flex-col gap-1 flex-1 min-h-0 overflow-y-auto">
-									<SessionPicker {isCollapsed} embedded collapsible={false} />
-								</div>
-								{@render settingsMenu(isCollapsed)}
-							{:else}
-								<!-- Navigation mode: Home → Settings scroll as ONE block with an
-								     overflow fade hint. The three sections (Home/Runs + Favorites +
-								     Search / workspace items / instance settings) are spaced by the
-								     scroll area's gap rather than each scrolling on its own. -->
-								<SidebarScrollArea color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}>
-									<!-- Section 1: Home/Runs + Favorites + Search -->
-									<div class="px-2 pt-1 flex flex-col gap-1">
-										{@render quickLinks(isCollapsed)}
-										<Menubar class="flex flex-col gap-1">
-											{#snippet children({ createMenu })}
-												<FavoriteMenu
-													{createMenu}
-													favoriteLinks={favoriteManager.current}
-													{isCollapsed}
-												/>
-											{/snippet}
-										</Menubar>
-										<MenuButton
-											stopPropagationOnClick={true}
-											on:click={() => openSearchModal()}
-											{isCollapsed}
-											icon={Search}
-											label="Search"
-											class="!text-xs"
-											shortcut={`${getModifierKey()}k`}
-										/>
-										{#if askAiShown}
-											<!-- Legacy Ask-AI pane, shown only when the user opted out of the
-											     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
-											<MenuButton
-												stopPropagationOnClick={true}
-												on:click={() => aiChatManager.toggleOpen()}
-												{isCollapsed}
-												icon={WandSparkles}
-												iconProps={{ forceDarkMode: true }}
-												label="Ask AI"
-												class="!text-xs"
-												iconClasses="!text-ai"
-												shortcut={`${getModifierKey()}L`}
-											/>
-										{/if}
-									</div>
-
-									<!-- Section 2: workspace items -->
-									<SidebarContent
-										{isCollapsed}
-										showSecondary={false}
-										excludeMainLabels={['Home', 'Runs']}
-										numUnacknowledgedCriticalAlerts={isCriticalAlertsUiMuted
-											? 0
-											: numUnacknowledgedCriticalAlerts}
-									/>
-
-									<!-- Section 3: instance settings — mt-auto drops it to the bottom
-									     when the column has spare room, and collapses back to the normal
-									     inter-section gap once the content overflows and scrolls. -->
-									<div class="mt-auto">
-										{@render settingsMenu(isCollapsed)}
-									</div>
-								</SidebarScrollArea>
-							{/if}
-
-							<div class="flex-shrink-0">
-								{@render accountSetupBanner(isCollapsed)}
-								<SidebarUsage {isCollapsed} />
-							</div>
-
-							<div
-								class="flex-shrink-0 flex pt-3 pb-3.5 {isCollapsed
-									? 'flex-col items-center gap-3'
-									: 'items-center justify-between px-4'}"
-							>
-								{@render brandMark(isCollapsed)}
-								<!-- p-2/-m-2 widens the hit area to ~32px without moving the icon. -->
-								<button
-									class="p-2 -m-2 rounded hover:bg-surface-hover"
-									title={isCollapsed ? 'Expand sidebar' : 'Collapse sidebar'}
-									onclick={() => {
-										isCollapsed = !isCollapsed
-										// Manual toggle is the persisted preference (auto-collapse isn't).
-										collapsePref.val = isCollapsed
-									}}
-								>
-									{#if isCollapsed}
-										<PanelLeftOpen size={14} class="flex-shrink-0 h-3.5 w-3.5 text-hint" />
-									{:else}
-										<PanelLeftClose size={14} class="flex-shrink-0 h-3.5 w-3.5 text-hint" />
-									{/if}
-								</button>
-							</div>
+							{@render sidebarColumn(true)}
 						</div>
 					</div>
-				{/if}
+				</div>
 			{:else}
-				<div class="absolute top-1 left-1 z5000">
-					<OperatorMenu favoriteLinks={favoriteManager.current} />
+				<div
+					id="sidebar"
+					class={classNames(
+						dockToggled ? '' : 'wm-sidebar-in',
+						// The rail owns the full height of the left edge; the band starts to its right.
+						'flex flex-col fixed inset-y-0 z-40 ',
+						sidebarTransitionClass,
+						devOnly ? '!hidden' : ''
+					)}
+					style:width="{railWidth}rem"
+					in:railMorph={{ offscreen: false }}
+					out:railMorph={{ offscreen: true }}
+				>
+					{@render sidebarColumn(false)}
 				</div>
 			{/if}
-			<!-- Legacy menu -->
-			<div
-				class={classNames(
-					'fixed inset-0 bg-black/50 transition-opacity ease-linear duration-300',
-					'opacity-0 pointer-events-none'
-				)}
-			>
-				<div class={twMerge('fixed inset-0 flex ', '-z-0')}>
-					<div
-						class={classNames(
-							'relative flex-1 flex flex-col max-w-min w-full bg-surface transition ease-in-out duration-100 transform',
-							'-translate-x-full'
-						)}
-					>
-						<div
-							class={classNames(
-								'absolute top-0 right-0 -mr-12 pt-2 ease-in-out duration-100',
-								'opacity-0'
-							)}
-						>
-							<button
-								type="button"
-								onclick={() => {
-									// menuSlide = !menuSlide
-								}}
-								aria-label="Close"
-								class="ml-1 flex items-center justify-center h-8 w-8 rounded-full focus:outline-none focus:ring-2 focus:ring-inset focus:ring-white border border-white"
-							>
-								<svg
-									class="h-6 w-6 text-white"
-									xmlns="http://www.w3.org/2000/svg"
-									fill="none"
-									viewBox="0 0 24 24"
-									stroke-width="2"
-									stroke="currentColor"
-									aria-hidden="true"
-								>
-									<path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
-								</svg>
-							</button>
-						</div>
-						<div class="h-full" style:background-color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}>
-							<div
-								class="flex gap-x-2 flex-shrink-0 p-4 font-semibold text-emphasis w-10"
-								class:w-40={!isCollapsed}
-							>
-								<WindmillIcon white={darkMode} height="20px" width="20px" />
-								{#if !isCollapsed}{#if $whitelabelNameStore}{capitalize(
-											$whitelabelNameStore
-										)}{:else}Windmill{/if}{/if}
-							</div>
-
-							<div class="px-2 py-4 space-y-2 border-y border-light dark:border-gray-700">
-								<Menubar>
-									{#snippet children({ createMenu })}
-										<WorkspaceMenu {createMenu} />
-										<FavoriteMenu {createMenu} favoriteLinks={favoriteManager.current} />
-									{/snippet}
-								</Menubar>
-								<MenuButton
-									stopPropagationOnClick={true}
-									on:click={() => openSearchModal()}
-									{isCollapsed}
-									icon={Search}
-									label="Search"
-									class="!text-xs"
-									shortcut={`${getModifierKey()}k`}
-								/>
-								{#if !$copilotInfo.workspaceDisabled}
-									<MenuButton
-										stopPropagationOnClick={true}
-										on:click={() => aiChatManager.toggleOpen()}
-										{isCollapsed}
-										icon={WandSparkles}
-										iconProps={{
-											forceDarkMode: true
-										}}
-										label="Ask AI"
-										class="!text-xs"
-										iconClasses="!text-ai"
-										shortcut={`${getModifierKey()}L`}
-									/>
-								{/if}
-							</div>
-
-							<SidebarContent
-								{isCollapsed}
-								numUnacknowledgedCriticalAlerts={isCriticalAlertsUiMuted
-									? 0
-									: numUnacknowledgedCriticalAlerts}
-							/>
-						</div>
-					</div>
-				</div>
-			</div>
 		{/if}
-		<div class="flex flex-col h-full w-full">
+		<div class="flex flex-col h-full w-full relative">
 			<!-- Not gated on `$enterpriseLicense`: it paints the cached accent before the license
 			     resolves, and checks the license itself. -->
 			<InstanceUiSync />
+			<!-- `menuHidden` hides the workspace navigation, not the page: an embedded Runs or detail
+			     page keeps its own controls, which now live in this band and nowhere else. The band
+			     renders without its breadcrumb there, so the embed gains no workspace nav. -->
+			{#if !devOnly && (!menuHidden || pageHeader.actions.length > 0)}
+				{@const rightInset = pageHeader.content?.barRightInset}
+				{@const leftInset = useDrawer || menuHidden ? 0 : railWidth}
+				<!-- One element for every placement, styled rather than branched: a page registers its
+				     inset on mount, and swapping between two `{#if}` arms would destroy the band and
+				     build another one a frame later — a blink of no header, with the content sliding
+				     up into the gap and the workspace menu losing the trigger it hangs from.
+				     In flow, the band spans the content beside the rail. With an inset, a page owns
+				     the right edge from the top (a session's side panel): the band floats, stopping
+				     where that column starts, and the page pads its own content to clear it. -->
+				<div
+					class={classNames(floatBand ? 'absolute top-0 z-30' : 'shrink-0', bandTransitionClass)}
+					style:left={floatBand ? `${leftInset}rem` : undefined}
+					style:right={floatBand ? `${rightInset ?? 0}px` : undefined}
+					style:padding-left={floatBand ? undefined : `${leftInset}rem`}
+				>
+					<PageHeaderBar navHidden={menuHidden} panelled={useDrawer} />
+				</div>
+			{/if}
 			{#if $enterpriseLicense && !menuHidden}
 				<!-- Announcements are an EE feature, so the component never mounts on CE. Also
 				     skipped when the menu is hidden — that is an embed or an OAuth callback,
@@ -1517,9 +1485,6 @@
 					</button>
 				</div>
 			{/if}
-			<!-- Operators are exempt from the sessions beta: their minimal sidebar has
-			     no Workspace ⇄ Sessions switch, so disabling the docked chat would leave
-			     their "Ask AI" button toggling an unmounted pane. -->
 			<AiChatLayout
 				{children}
 				noPadding={devOnly || menuHidden}
@@ -1528,10 +1493,7 @@
 				showSessionsBetaBanner={!$userStore?.operator}
 				sidebarWidth={railWidth}
 				transitionClass={sidebarTransitionClass}
-				isMobile={innerWidth < 768}
-				onMenuOpen={() => {
-					menuOpen = true
-				}}
+				isMobile={useDrawer}
 			/>
 		</div>
 	</div>
diff --git a/frontend/src/routes/(root)/(logged)/+page.svelte b/frontend/src/routes/(root)/(logged)/+page.svelte
index 015ab00400..2416a1a2bc 100644
--- a/frontend/src/routes/(root)/(logged)/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/+page.svelte
@@ -19,11 +19,13 @@
 	import { writable } from 'svelte/store'
 	import type { EditorBreakpoint } from '$lib/components/apps/types'
 	import { setQuery } from '$lib/navigation'
+	import { useReducedMotion } from '$lib/svelte5Utils.svelte'
 	import { page } from '$app/state'
 	import { goto, replaceState } from '$app/navigation'
 	import ForkWorkspaceBanner from '$lib/components/ForkWorkspaceBanner.svelte'
 	import WorkspaceDraftsBanner from '$lib/components/WorkspaceDraftsBanner.svelte'
 	import NoDirectDeployAlert from '$lib/components/NoDirectDeployAlert.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
 	import { useSearchParams } from '$lib/svelte5UtilsKit.svelte'
 	import { z } from 'zod'
 	import HomeAIChat from '$lib/components/home/HomeAIChat.svelte'
@@ -92,6 +94,22 @@
 
 	let showCreateButtons = $state(false)
 
+	// A workspace switch keeps this page mounted and swaps its contents under the reader, which
+	// the mount animation below never covers. Replay it by hand instead of keying the page on the
+	// workspace: a remount would drop the list's own state and refetch what it is already loading.
+	let pageEl: HTMLDivElement | undefined = $state(undefined)
+	const reducedMotion = useReducedMotion()
+	let animatedWorkspace = $workspaceStore
+	$effect(() => {
+		const ws = $workspaceStore
+		if (ws === animatedWorkspace) return
+		animatedWorkspace = ws
+		untrack(() => {
+			if (!pageEl || reducedMotion.val) return
+			pageEl.animate([{ opacity: 0 }, { opacity: 1 }], { duration: 500, easing: 'ease-out' })
+		})
+	})
+
 	let operatorTour: OperatorTour | undefined = $state(undefined)
 
 	// Delayed so the tabs the first steps point at exist. `runTutorial` refuses while a tour is
@@ -262,16 +280,25 @@
 	</DrawerContent>
 </Drawer>
 
+{#snippet editRuleBadge()}
+	<NoDirectDeployAlert onUpdateCanEditStatus={(v) => (showCreateButtons = v)} />
+{/snippet}
+
 <div
+	bind:this={pageEl}
 	class="wm-page-in flex flex-col w-full h-full overflow-y-auto items-center"
 	style="scrollbar-gutter: stable both-edges;"
 >
+	<!-- Where edits to this workspace are made is a fact about the workspace, so it sits in the
+	     header with the workspace's own name rather than above the list. -->
+	<PageHeaderContent actions={editRuleBadge} />
+
 	<ForkWorkspaceBanner />
 	<WorkspaceDraftsBanner />
 	<div class="max-w-7xl px-4 sm:px-8 md:px-8 h-fit w-full mb-6">
 		<!-- HomeAIChat carries both the AI composer and the AI-independent CLI/MCP connect row,
-		     so it shows whenever the sessions beta is on; the composer itself is gated on operator
-		     status and on the workspace inside the component, which owns its own vertical spacing
+		     so it shows whenever the sessions beta is on; the composer itself is gated on the
+		     workspace inside the component, which owns its own vertical spacing
 		     because the hero and the bare connect row want different amounts of it. -->
 		{#if isGlobalAiEnabled()}
 			<HomeAIChat />
@@ -286,10 +313,6 @@
 			</div>
 		{/if}
 
-		<div class="max-w-[40rem] mx-auto">
-			<NoDirectDeployAlert onUpdateCanEditStatus={(v) => (showCreateButtons = v)} />
-		</div>
-
 		{#if tab == 'hub'}
 			<div class="flex flex-col gap-y-16">
 				<div class="flex flex-col pb-8">
diff --git a/frontend/src/routes/(root)/(logged)/agents/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/agents/edit/[...path]/+page.svelte
index b4539d0a8e..f78192c34c 100644
--- a/frontend/src/routes/(root)/(logged)/agents/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/agents/edit/[...path]/+page.svelte
@@ -17,7 +17,7 @@
 	})
 </script>
 
-<div class="h-screen w-full">
+<div class="h-full w-full">
 	<AgentEditorModal
 		layout="page"
 		enableAi={$copilotInfo.enabled}
diff --git a/frontend/src/routes/(root)/(logged)/agents/get/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/agents/get/[...path]/+page.svelte
index f6de4c078e..3070345ddf 100644
--- a/frontend/src/routes/(root)/(logged)/agents/get/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/agents/get/[...path]/+page.svelte
@@ -15,10 +15,12 @@
 	import AgentEditorHost from '$lib/components/flows/content/AgentEditorHost.svelte'
 	import AgentConfigModal from '$lib/components/flows/content/AgentConfigModal.svelte'
 	import RunForm from '$lib/components/RunForm.svelte'
+	import { Alert } from '$lib/components/common'
 	import { keepsManagedMemory } from '$lib/components/flows/agentFormFields'
 	import { agentMenuItems, deleteAgent } from '$lib/components/flows/agentActions'
 	import { getDeployUiSettings } from '$lib/components/home/deploy_ui'
 	import { userStore, workspaceStore } from '$lib/stores'
+	import { sendUserToast } from '$lib/toast'
 
 	/**
 	 * The deployed agent, as a flow's or a script's page shows theirs: a way to run it, a chat when
@@ -27,6 +29,8 @@
 	let path = $derived(page.params.path ?? '')
 	let ws = $derived($workspaceStore)
 
+	/** Bumped to read the agent again after it was renamed in place. */
+	let reloaded = $state(0)
 	let host = $state<ReturnType<typeof AgentEditorHost> | undefined>(undefined)
 	let agent = $derived(host?.draftHandle())
 	let testPane = $derived(host?.testPaneHandle())
@@ -39,6 +43,21 @@
 	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state(undefined)
 	let deleteOpen = $state(false)
 	let evalsModal: AgentEvalsModal | undefined = $state(undefined)
+	let runForm: RunForm | undefined = $state(undefined)
+	let isValid = $state(true)
+
+	// Cmd/Ctrl+Enter runs the form, as on a script's or a flow's page. The form stays mounted, hidden,
+	// while the chat shows, and the chat's composer owns the key then.
+	function onKeyDown(event: KeyboardEvent) {
+		if (event.defaultPrevented || event.key !== 'Enter' || !(event.ctrlKey || event.metaKey)) return
+		if (!runForm || testPane?.mode === 'chat') return
+		if (isValid) {
+			event.preventDefault()
+			runForm.run()
+		} else {
+			sendUserToast('Please fix errors before running', true)
+		}
+	}
 
 	async function remove() {
 		if (ws && (await deleteAgent(ws, path))) await goto(`${base}/?kind=agent`)
@@ -86,11 +105,27 @@
 	<span>Every flow that links {path} will fail at its agent step once it is deleted.</span>
 </ConfirmationModal>
 
-<main class="h-screen w-full flex flex-col">
+<svelte:window onkeydown={onKeyDown} />
+
+<main class="h-full w-full flex flex-col">
+	<!-- `labels`: the pen saves every field it shows in one write, so the labels it shows have to be
+	     the ones the resource carries. Handed none, it would offer an empty list, and the first
+	     label added there would replace the agent's own. -->
 	<DetailPageHeader
+		ownsPageHeader
+		itemKind="agent"
 		summary={config ? agent?.state?.description : undefined}
+		labels={agent?.state?.labels}
 		{path}
 		{menuItems}
+		onSaved={canEdit
+			? async (newPath) => {
+					// A rename moves the page; a summary saved in place has to be read again, since
+					// what is shown here came from the load this page keys on.
+					if (newPath !== path) await goto(`${base}/agents/get/${newPath}`)
+					else reloaded++
+				}
+			: undefined}
 		mainButtons={[
 			// Evaluating an agent builds datasets and runs against it: authoring, as editing is.
 			...(canEdit
@@ -154,7 +189,7 @@
 		{/snippet}
 	</DetailPageHeader>
 	<div class="flex-1 min-h-0">
-		{#key `${ws}:${path}`}
+		{#key `${ws}:${path}:${reloaded}`}
 			<AgentEditorHost
 				bind:this={host}
 				{path}
@@ -164,6 +199,14 @@
 				onOpenConfig={() => configModal?.open()}
 			>
 				{#snippet viewForm({ schema, run, loading, actions })}
+					{#if config && !chatAvailable}
+						<Alert type="info" size="xs" title="Managed memory is off" class="mb-4">
+							Each run is answered on its own inputs, so this agent has no chat. That suits reusing
+							it as a step in a flow.{canEdit
+								? ' Turn on managed memory in its configuration to chat with it.'
+								: ''}
+						</Alert>
+					{/if}
 					<RunForm
 						runnable={{ schema, path }}
 						runAction={run}
@@ -172,6 +215,8 @@
 						autofocus
 						{loading}
 						{actions}
+						bind:isValid
+						bind:this={runForm}
 					/>
 				{/snippet}
 			</AgentEditorHost>
diff --git a/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
index e81dfb9e90..974d1c7f64 100644
--- a/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
@@ -468,8 +468,9 @@
 
 {#key redraw}
 	{#if app}
-		<div class="h-screen">
+		<div class="h-full">
 			<AppEditor
+				ownsPageHeader
 				{fromHub}
 				onSavedNewAppPath={(url) => {
 					goto(`/apps/edit/${url}`)
diff --git a/frontend/src/routes/(root)/(logged)/apps/get/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps/get/[...path]/+page.svelte
index 4ff8670cda..c911a8a64c 100644
--- a/frontend/src/routes/(root)/(logged)/apps/get/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps/get/[...path]/+page.svelte
@@ -24,7 +24,7 @@
 	     must fully remount — otherwise the previous app (and in sandbox mode its
 	     path-scoped token) sticks around. -->
 	{#key `${workspace}/${path}`}
-		<InWorkspaceAppViewer {workspace} {path} />
+		<InWorkspaceAppViewer {workspace} {path} ownsPageHeader />
 	{/key}
 {:else}
 	<Skeleton layout={[10]} />
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
index fec356d89a..9ed2ca296a 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
@@ -624,9 +624,11 @@
 
 {#if files}
 	{#key redraw}
-		<div class="h-screen">
+		<div class="h-full">
 			<RawAppEditor
 				bind:this={rawAppEditor}
+				ownsPageHeader
+				onDetails={(e) => goto(`/apps_raw/get/${e.path}?workspace=${$workspaceStore}`)}
 				onSavedNewAppPath={(savedPath) => {
 					draftSync.remove()
 					goto(`/apps_raw/edit/${savedPath}`)
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/get/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps_raw/get/[...path]/+page.svelte
index 79c8145731..672b0f9feb 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/get/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/get/[...path]/+page.svelte
@@ -18,7 +18,7 @@
 	<!-- Key by target: SvelteKit reuses this page component on in-route
 	     navigation, so the viewer must fully remount (see /apps/get). -->
 	{#key `${workspace}/${path}`}
-		<InWorkspaceAppViewer {workspace} {path} />
+		<InWorkspaceAppViewer {workspace} {path} ownsPageHeader />
 	{/key}
 {:else}
 	<Skeleton layout={[10]} />
diff --git a/frontend/src/routes/(root)/(logged)/audit_logs/+page.svelte b/frontend/src/routes/(root)/(logged)/audit_logs/+page.svelte
index 59c961febb..42d8ff996e 100644
--- a/frontend/src/routes/(root)/(logged)/audit_logs/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/audit_logs/+page.svelte
@@ -7,6 +7,8 @@
 	import AuditLogsTable from '$lib/components/auditLogs/AuditLogsTable.svelte'
 	import AuditLogMobileFilters from '$lib/components/auditLogs/AuditLogMobileFilters.svelte'
 	import { Alert, DrawerContent, Skeleton } from '$lib/components/common'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
 
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
 	import AnimatedPane from '$lib/components/splitPanes/AnimatedPane.svelte'
@@ -64,11 +66,26 @@
 	)
 	let auditLogDrawer: Drawer | undefined = $state()
 
-	// The inline filters show only when their one-line width fits in the space the title leaves.
-	// Both are measured, so the sidebar, side panels, zoom and filter values are all accounted for.
-	let filtersSlotWidth = $state(0)
+	// The inline filters show only when their one-line width fits the bar. The row is measured, so
+	// the sidebar, side panels, zoom and the filters' own values are all accounted for; what it is
+	// measured against is the bar, not the box it sits in. That box is the band's action area,
+	// whose width is its own content's — measuring the row against it would ask whether the row
+	// fits inside itself, which it always does, and the filters would never fold.
 	let filtersRowWidth = $state(0)
-	let inlineFilters = $derived(filtersRowWidth > 0 && filtersRowWidth <= filtersSlotWidth)
+	/** What the breadcrumb takes before the filters get any: the workspace disc and name, the
+	 *  page's name and the hint beside it. Measured at 361-398px across bar widths. */
+	const BREADCRUMB_WIDTH = 400
+	/** Clear space held between the breadcrumb and the first filter. The breadcrumb yields width
+	 *  grudgingly and the filter row not at all, so when the two are sized to just meet they
+	 *  overlap instead of compressing — and mid-resize, before the breadcrumb has settled, the
+	 *  tooltip at the end of it lands on the timeframe button. Measured without this: the gap
+	 *  reached 4px across a 1600->1200 sweep. */
+	const BREADCRUMB_GAP = 48
+	let inlineFilters = $derived(
+		filtersRowWidth > 0 &&
+			pageHeader.barWidth > 0 &&
+			filtersRowWidth <= pageHeader.barWidth - BREADCRUMB_WIDTH - BREADCRUMB_GAP
+	)
 
 	// Function to fetch missing job execution audit logs
 	async function fetchMissingJobSpan(jobId: string, jobLogs: AuditLog[]): Promise<AuditLog[]> {
@@ -117,19 +134,21 @@
 		<p>Page not available for operators</p>
 	</div>
 {:else}
-	<div class="flex flex-col w-full h-screen">
-		<div class="flex flex-row items-center justify-between gap-4 px-4 py-2 my-4">
-			<div class="flex flex-row shrink-0 gap-1 items-center">
-				<h1 class="text-2xl font-semibold text-emphasis">Audit logs</h1>
-				<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/audit_logs">
-					You can only see your own audit logs unless you are an admin.
-				</Tooltip>
-			</div>
-			<!-- flex-1 min-w-0: the slot's width is what the title leaves, whatever its content. -->
-			<div
-				class="relative flex flex-row flex-1 min-w-0 justify-end items-center"
-				bind:clientWidth={filtersSlotWidth}
-			>
+	<!-- `h-full`, not `h-screen`: the band sits above this box, so a viewport floor would overhang
+	     the content box by the band's height. -->
+	<div class="flex flex-col w-full h-full">
+		<!-- `afterName`, not an action: the hint explains what audit logs are, so it belongs beside
+		     the page's name rather than at the far end of the bar with the filters. -->
+		<PageHeaderContent afterName={auditHint} actions={auditActions} actionsFlexible />
+
+		{#snippet auditHint()}
+			<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/audit_logs">
+				You can only see your own audit logs unless you are an admin.
+			</Tooltip>
+		{/snippet}
+
+		{#snippet auditActions()}
+			<div class="relative flex flex-row min-w-0 justify-end items-center">
 				<!-- Kept laid out (invisible, out of flow) while unused, so its width stays measurable. -->
 				<div
 					class={inlineFilters
@@ -171,7 +190,7 @@
 					</AuditLogMobileFilters>
 				</div>
 			</div>
-		</div>
+		{/snippet}
 		{#if !$enterpriseLicense || $enterpriseLicense.endsWith('_pro')}
 			<div class="mx-4 mb-2">
 				<Alert title="Redacted audit logs" type="warning">
diff --git a/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
index 835735c0c8..d724c4873d 100644
--- a/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
@@ -557,6 +557,7 @@
 	</div>
 {:else if renderEditor}
 	<FlowBuilder
+		ownsPageHeader
 		onTakeLatest={draftBaseVersion
 			? async (shown?: string) => {
 					// The version the drawer showed as head; see /scripts/edit.
diff --git a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
index a21fa36835..aa158d2f11 100644
--- a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
 	import CompareWorkspaces from '$lib/components/CompareWorkspaces.svelte'
 	import CompareDrafts from '$lib/components/CompareDrafts.svelte'
 	import { WorkspaceService, type WorkspaceComparison } from '$lib/gen'
@@ -31,10 +32,22 @@
 
 	type CompareMode = 'fork' | 'draft'
 
-	let comparison: WorkspaceComparison | undefined = $state(undefined)
+	/** The last comparison that came back, with the pair it describes. Kept together: a comparison
+	 *  is only an answer about the two workspaces it was asked about. */
+	let comparisonResult = $state<{ pair: string; value: WorkspaceComparison } | undefined>(undefined)
 
-	let currentWorkspaceId: string | undefined = $state(
-		page.url.searchParams.get('workspace_id') ?? $workspaceStore ?? undefined
+	// Which workspace this page compares, read rather than followed. The URL answers it when it
+	// names one: `?workspace=` is a switch already made, which the root layout applies to the
+	// store, and `?workspace_id=` is the workspace a link asked to compare — a session's Review
+	// button passes the fork it committed to while deliberately leaving the navigation workspace
+	// alone (SessionChangesBar), as does the prod→dev link in UpdateDevWorkspaceModal, so it has
+	// to outrank the store. With neither param the store is the answer, and a switch in the trail
+	// moves the page because `fixupUrlAfterWorkspaceSwitch` rewrites whichever param is there.
+	const currentWorkspaceId = $derived(
+		page.url.searchParams.get('workspace') ??
+			page.url.searchParams.get('workspace_id') ??
+			$workspaceStore ??
+			undefined
 	)
 
 	let currentWorkspaceData = $derived($userWorkspaces.find((w) => w.id === currentWorkspaceId))
@@ -44,8 +57,21 @@
 	// one-off migration the lineage cannot express. It is one-way (current →
 	// target): nothing tallies such a pair, so a cold diff has no deploy history
 	// telling which side a change came from.
+	//
+	// Read whatever the URL holds, including on a page opened with no workspace param at all —
+	// which is how the migration starts, from "Merge into another workspace" in the workspace
+	// settings, and where the picker below is the only thing that sets this.
 	const targetParam = $derived(page.url.searchParams.get('target') ?? undefined)
 	const compareTargetId = $derived(targetParam ?? parentWorkspaceId ?? undefined)
+	/** The pair on screen, as one value: what a comparison has to describe to be about it. */
+	const pairKey = $derived(`${currentWorkspaceId}->${compareTargetId}`)
+	/** The comparison, but only while it describes the pair on screen. A switch changes the pair
+	 *  during render and the card is remounted in that same render, so a comparison handed over
+	 *  without this check would be the previous pair's — and the card would fetch that pair's item
+	 *  paths from the new workspace, where every one of them is a 404 by construction. */
+	const comparison = $derived(
+		comparisonResult?.pair === pairKey ? comparisonResult.value : undefined
+	)
 	const isArbitraryTarget = $derived(!!compareTargetId && compareTargetId !== parentWorkspaceId)
 	// Fork/dev workspaces are identified by their parent link, not the `wm-fork-` id
 	// prefix. Distinct from having a compare target: a root workspace has no parent
@@ -229,27 +255,40 @@
 			return
 		}
 		const seq = ++comparisonReq
+		// The pair this request is about, read before the await: by the time it answers the page
+		// may be on another one, and the answer belongs to the pair that was asked.
+		const pair = pairKey
+		comparisonLoading = true
 
 		try {
 			const result = await fetchWorkspaceComparison(compareTargetId, currentWorkspaceId)
 			if (seq !== comparisonReq) return
-			comparison = result
+			comparisonResult = { pair, value: result }
 			comparisonError = undefined
 		} catch (e: any) {
 			if (seq !== comparisonReq) return
 			comparisonError = e?.body ?? e?.message ?? String(e)
 			console.error('Failed to compare workspaces:', e)
+		} finally {
+			// Only the request still being waited on clears the flag: an older one landing late
+			// would otherwise report the newer pair as answered.
+			if (seq === comparisonReq) comparisonLoading = false
 		}
 	}
 
 	let comparisonError = $state<string | undefined>(undefined)
+	/** Tracked rather than inferred from an absent comparison: a failed one is also absent, and a
+	 *  spinner that never stops is worse than a message. */
+	let comparisonLoading = $state(false)
 
 	$effect(() => {
 		;[currentWorkspaceId, compareTargetId]
 
 		untrack(() => {
-			comparison = undefined
 			comparisonError = undefined
+			// The flag belongs to `checkForChanges`, which raises it per request and lowers it for
+			// the one still being waited on. Raising it here too left it stuck on the pair that
+			// function refuses — no workspace, or no target yet.
 			checkForChanges()
 		})
 	})
@@ -257,33 +296,48 @@
 	// Seeding the candidate set is what makes an arbitrary pair comparable at all;
 	// the comparison that follows is the expensive part, since it evaluates every
 	// candidate. Both are driven from here so the button reports the whole wait.
-	let scanning = $state(false)
+	/** The pair being scanned, so the button reports the wait for the pair it belongs to and not
+	 *  for whichever one the trail moved to meanwhile. */
+	let scanningPair = $state<string | undefined>(undefined)
+	const scanning = $derived(scanningPair === pairKey)
 	async function computeFullScan() {
 		if (!currentWorkspaceId || !compareTargetId) return
-		scanning = true
+		// Captured before the await, and used afterwards in place of the live values: the scan
+		// seeded this pair, so this is the pair to invalidate, re-compare and name in the toast.
+		const scanWorkspace = currentWorkspaceId
+		const scanTarget = compareTargetId
+		const pair = pairKey
+		scanningPair = pair
 		comparisonError = undefined
 		try {
 			const res = await WorkspaceService.seedFullDiffScan({
-				workspace: currentWorkspaceId,
-				targetWorkspaceId: compareTargetId
+				workspace: scanWorkspace,
+				targetWorkspaceId: scanTarget
 			})
-			invalidateWorkspaceComparison(compareTargetId)
-			await checkForChanges()
-			// The seed succeeded but the comparison that reads it may not have. Saying
-			// "compared" then would be a lie, and the seeded candidates are still there
-			// for the retry the card offers.
-			if (comparisonError) {
+			invalidateWorkspaceComparison(scanTarget)
+			// Only worth re-asking while the page is still on the pair that was scanned; it asks
+			// for the pair it moved to on its own.
+			if (pairKey === pair) await checkForChanges()
+			// Each outcome says what actually happened. Off the scanned pair nothing was compared —
+			// the re-ask above is skipped — so only the seed can be reported; `comparisonError`
+			// there belongs to another pair and says nothing about this one. On it, the seed can
+			// still have succeeded while the comparison reading it failed, and claiming "compared"
+			// would be a lie with the seeded candidates sitting there for the retry the card offers.
+			if (pairKey !== pair) {
+				sendUserToast(`Seeded ${res.candidates} items for ${scanTarget}`)
+			} else if (comparisonError) {
 				sendUserToast(
 					`Seeded ${res.candidates} items but the comparison failed: ${comparisonError}`,
 					true
 				)
 			} else {
-				sendUserToast(`Compared ${res.candidates} items with ${compareTargetId}`)
+				sendUserToast(`Compared ${res.candidates} items with ${scanTarget}`)
 			}
 		} catch (e: any) {
 			sendUserToast(`Failed to compute the diff: ${e?.body ?? e}`, true)
 		} finally {
-			scanning = false
+			// Only the scan still being waited on stops the button; a later one owns it now.
+			if (scanningPair === pair) scanningPair = undefined
 		}
 	}
 
@@ -390,6 +444,17 @@
 	}
 </script>
 
+<!-- Named here rather than left to the route: the breadcrumb's fallback reads the first segment,
+     which would call this page "Forks" — the thing it compares, not what it is.
+     `actingWorkspaceId` only when the page is comparing a workspace other than the one the app is
+     pointed at, which is how a session's Review button and the prod→dev link open it: the trail
+     would otherwise name the parent while the page compares the fork, and its home link would
+     lead somewhere the page is not. -->
+<PageHeaderContent
+	section={{ label: 'Compare' }}
+	actingWorkspaceId={currentWorkspaceId !== $workspaceStore ? currentWorkspaceId : undefined}
+/>
+
 <CenteredPage>
 	<PageHeader title="Compare & Deploy">
 		<div class="flex flex-row gap-2 items-center">
@@ -440,10 +505,12 @@
 			onModeSelected={selectMode}
 		/>
 	{:else if compareTargetId}
-		<!-- Remount on a target change: the merge card owns a selection, a deploy
-		     direction and per-item deployment statuses, none of which carry over to a
-		     different destination. -->
-		{#key compareTargetId}
+		<!-- Remount on either side of the pair changing: the merge card owns a selection, a deploy
+		     direction, per-item deployment statuses, item summaries, pinned rows, deploy
+		     permissions and CI results — none of which carry over to a different pair. Keyed on
+		     the target alone, two forks of one parent shared a mount, since the target is the
+		     parent they have in common. -->
+		{#key pairKey}
 			<CompareWorkspaces
 				{currentWorkspaceId}
 				parentWorkspaceId={compareTargetId}
@@ -456,6 +523,7 @@
 				onSelectTarget={selectTarget}
 				{comparison}
 				{comparisonError}
+				{comparisonLoading}
 				initialMergeIntoParent={forkDirection === 'deploy_to'}
 				{deployCount}
 				{updateCount}
diff --git a/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte b/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte
index 1515040f18..d7972d3ef1 100644
--- a/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte
@@ -3,8 +3,9 @@
 	import PipelineFolderList from '$lib/components/assets/AssetGraph/PipelineFolderList.svelte'
 	import PipelineSetupSignpost from '$lib/components/assets/AssetGraph/PipelineSetupSignpost.svelte'
 	import PipelineAlphaAckModal from '$lib/components/assets/AssetGraph/PipelineAlphaAckModal.svelte'
-	import PipelineDbtSignpost from '$lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte'
-	import { BookOpen, NetworkIcon } from 'lucide-svelte'
+	import { BookOpen } from 'lucide-svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import { onMount } from 'svelte'
 
 	const ACK_STORAGE_KEY = 'pipeline-alpha-ack'
@@ -36,39 +37,27 @@
 	<title>Pipelines — Windmill</title>
 </svelte:head>
 
-<div class="flex flex-col h-full">
-	<div
-		class="border-b flex flex-row justify-between gap-2 px-2 py-1 items-center min-h-10 shrink-0 whitespace-nowrap"
-	>
-		<div class="flex flex-row items-center gap-2">
-			<NetworkIcon size={16} class="text-tertiary shrink-0" />
-			<h1 class="text-sm font-semibold">Pipelines</h1>
-			<span
-				class="text-2xs px-1.5 py-0.5 rounded font-semibold bg-emerald-100 text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-300"
-			>
-				Alpha
-			</span>
-		</div>
-	</div>
+<!-- No title row of its own: the band already names this page, and the badge that sat beside the
+     title rides after that name. -->
+<PageHeaderContent section={{ label: 'Pipelines' }} afterName={alphaBadge} separator="always" />
 
+{#snippet alphaBadge()}
+	<Badge color="green">Alpha</Badge>
+{/snippet}
+
+<div class="flex flex-col h-full">
 	<div class="flex-1 min-h-0 overflow-y-auto bg-surface-secondary">
 		<div class="max-w-2xl mx-auto flex flex-col gap-6 px-4 py-8">
 			<div class="flex flex-col gap-2">
-				<h2 class="text-lg font-semibold">Data pipelines</h2>
-				<p class="text-sm text-tertiary">
+				<h2 class="text-lg font-semibold text-emphasis">Data pipelines</h2>
+				<p class="text-xs text-secondary">
 					Chain ingestion, transformation and materialization steps into an asset-aware graph.
-					{#if !$userStore?.operator}
-						Each pipeline lives in a folder: open one below, or pick a folder to start a new
-						pipeline.
-					{:else}
-						Open a pipeline below to view its graph and runs.
-					{/if}
 				</p>
 				<a
 					href="https://www.windmill.dev/docs/pipelines"
 					target="_blank"
 					rel="noreferrer"
-					class="text-xs text-blue-500 hover:underline inline-flex items-center gap-1"
+					class="text-xs text-accent hover:underline inline-flex items-center gap-1 w-fit"
 				>
 					<BookOpen size={12} />
 					Pipelines documentation
@@ -79,14 +68,8 @@
 				<PipelineSetupSignpost workspace={$workspaceStore} />
 			{/if}
 
-			<PipelineFolderList />
-
-			<!-- Below the pipeline content on purpose: dbt is a separate runtime, not a
-			     way of building a pipeline, and reads as one when it sits in the flow
-			     that defines what a pipeline is. -->
-			{#if !$userStore?.operator}
-				<PipelineDbtSignpost />
-			{/if}
+			<!-- Operators cannot pick an arbitrary folder, so the list is their only way in. -->
+			<PipelineFolderList hideExisting={!$userStore?.operator} />
 		</div>
 	</div>
 </div>
diff --git a/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte b/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
index b4ddb8350c..8cf9248b6a 100644
--- a/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
@@ -1,7 +1,9 @@
 <script lang="ts">
+	import pLimit from 'p-limit'
 	import { workspaceStore, userStore } from '$lib/stores'
 	import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
 	import { base } from '$lib/base'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
 	import { page } from '$app/state'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
@@ -18,16 +20,13 @@
 	import { usePipelineHistory } from '$lib/components/assets/AssetGraph/pipelineHistory.svelte'
 	import PipelineActivityPanel from '$lib/components/assets/AssetGraph/PipelineActivityPanel.svelte'
 	import PipelinePickerModal from '$lib/components/assets/AssetGraph/PipelinePickerModal.svelte'
-	import {
-		extractWrites,
-		extractReads,
-		type AssetWithAltAccessType
-	} from '$lib/components/assets/lib'
 	import type {
 		AssetGraphResponse,
 		AssetGraphSelection,
 		NativeTriggerKind,
-		PipelineMode
+		PipelineMode,
+		PipelineTriggerDraft,
+		PipelineTriggerDraftKind
 	} from '$lib/components/assets/AssetGraph/types'
 	import PipelineModeToggle from '$lib/components/assets/AssetGraph/PipelineModeToggle.svelte'
 	import MacroExplorerDrawer from '$lib/components/assets/AssetGraph/MacroExplorerDrawer.svelte'
@@ -40,9 +39,13 @@
 		mergeColumnGraphs
 	} from '$lib/components/assets/AssetGraph/columnLineageGraph'
 	import { useDbtColumnLineage } from '$lib/components/assets/AssetGraph/dbtColumnLineage.svelte'
-	import { resolveGraph } from '$lib/components/assets/AssetGraph/resolveGraph'
+	import {
+		pipelineNodeErrors,
+		resolveGraph
+	} from '$lib/components/assets/AssetGraph/resolveGraph'
 	import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 	import { hideDbtRunnables } from '$lib/components/assets/AssetGraph/hideDbtRunnables'
+	import { usePipelineDataUploads } from '$lib/components/assets/AssetGraph/pipelineDataUploads.svelte'
 	import { buildSchemaContractContext } from '$lib/components/assets/AssetGraph/schemaContracts'
 	import {
 		computeDownstreamClosure,
@@ -79,18 +82,50 @@
 		createPipelineAiHelpers,
 		type PipelineDraft
 	} from '$lib/components/assets/AssetGraph/pipelineAiHelpers'
-	import { PipelineEditorState } from '$lib/components/assets/AssetGraph/pipelineEditorState.svelte'
+	import {
+		PipelineEditorState
+	} from '$lib/components/assets/AssetGraph/pipelineEditorState.svelte'
+	import {
+		defaultTriggerPath,
+		isDraftableTriggerKind,
+		triggerDraftKey
+	} from '$lib/components/assets/AssetGraph/pipelineTriggerDrafts'
+	import { deleteTriggerRow } from '$lib/components/assets/AssetGraph/pipelineTriggerDraftDeploy'
+	import {
+		deployPipelineDrafts,
+		deployPipelineScript
+	} from '$lib/components/assets/AssetGraph/pipelineDeploy.svelte'
+	import type { AssetUpstreamDelete } from '$lib/components/assets/AssetGraph/assetsOnlyView'
+	import type { NodeFixSpec } from '$lib/components/assets/AssetGraph/NodeFixButton.svelte'
+	import { TRIGGER_NODE_STYLE } from '$lib/components/assets/AssetGraph/TriggerNode.svelte'
+	import {
+		addTriggerDirective,
+		assetRef,
+		listenToAsset,
+		removeTriggerDirective,
+		stopListeningChangeText,
+		stopListeningToAsset
+	} from '$lib/components/assets/AssetGraph/pipelineAnnotationEdits'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import type { PipelineInsertOptions } from '$lib/components/assets/AssetGraph/PipelineInsertMenu.svelte'
 	import {
 		createPipelineRecording,
 		finalizePipelineRecording
 	} from '$lib/components/recording/pipelineRecording.svelte'
 	import type { PipelineRecording } from '$lib/components/recording/types'
 	import AutosaveIndicator from '$lib/components/AutosaveIndicator.svelte'
+	import { usePipelineAssetPrefetch } from '$lib/components/assets/AssetGraph/pipelineAssetPrefetch.svelte'
+	import PipelineDeployErrors from '$lib/components/assets/AssetGraph/PipelineDeployErrors.svelte'
+	import PipelineDeployTriggersModal from '$lib/components/assets/AssetGraph/PipelineDeployTriggersModal.svelte'
 	import { onMount, tick, untrack } from 'svelte'
+	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+	import OpenInSessionButton, {
+		type OpenInSessionSource
+	} from '$lib/components/sessions/OpenInSessionButton.svelte'
+	import { setOpenInSessionHandoff } from '$lib/components/sessions/openInSessionContext'
 	import { aiChatManager } from '$lib/components/copilot/chat/AIChatManager.svelte'
 	import {
 		AlertTriangle,
-		ArrowLeft,
 		ChevronDown,
 		Circle,
 		Download,
@@ -111,18 +146,15 @@
 		OpenAPI,
 		ScheduleService,
 		ScriptService,
+		AssetService,
 		type AssetKind,
 		type Script,
 		type ScriptLang
 	} from '$lib/gen'
 	import { resource } from 'runed'
 	import { emptySchema, sendUserToast, type Item } from '$lib/utils'
-	import type { Schema } from '$lib/common'
 	import { beforeNavigate, goto } from '$app/navigation'
 	import { fade } from 'svelte/transition'
-	import { twMerge } from 'tailwind-merge'
-	import Popover from '$lib/components/meltComponents/Popover.svelte'
-	import { inferArgs, inferAssets } from '$lib/infer'
 	import PipelineTriggerEditors from '$lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte'
 
 	// Variables and resources are declarative config, not pipeline assets —
@@ -130,7 +162,15 @@
 	// layout without adding lineage information.
 	const DATA_KINDS = DATA_ASSET_KINDS
 
-	let folder = $derived(normalizePipelineFolder(page.params.folder as string))
+	// The route param is gone for a moment while the page tears down on leaving; the
+	// folder keeps its last value so nothing keyed on it (draft autosave, graph
+	// fetch) sees a different folder in that window.
+	let lastFolder = ''
+	let folder = $derived.by(() => {
+		const param = page.params.folder
+		if (param !== undefined) lastFolder = normalizePipelineFolder(param)
+		return lastFolder
+	})
 
 	// Externalized editor state (drafts, live overlays, selection), shared with
 	// the in-session pipeline preview via PipelineEditorState. Referenced as
@@ -148,6 +188,8 @@
 			if (pe.folder !== f) {
 				if (pe.folder !== undefined) {
 					pe.reset()
+					// The set-aside edit pane belongs to the folder being left.
+					editPane = undefined
 					// Re-scope the Global chat's pipeline prompt to the new folder. The
 					// helper methods already read the reactive folder, but the system
 					// message string was built for the old one and is only rebuilt when
@@ -166,21 +208,45 @@
 	let isOperator = $derived($userStore?.operator ?? false)
 	let urlMode = $derived(page.url.searchParams.get('mode'))
 	let mode = $derived<PipelineMode>(isOperator ? 'view' : urlMode === 'edit' ? 'edit' : 'view')
+	// The edit-mode pane, set aside while View shows the activity feed, so coming
+	// back to Edit reopens it.
+	let editPane:
+		| { selection: typeof pe.selection; activeDraftPath: string | undefined; hidden: boolean }
+		| undefined = undefined
 	function setMode(m: PipelineMode, opts?: { replace?: boolean }) {
 		// Switching edit→view re-surfaces the activity feed: drop the edit-mode
 		// selection / open draft / hidden-pane state so view opens on Activity
 		// rather than a stale details pane (mirrors toggleActivity's show path).
 		if (m === 'view' && mode === 'edit') {
+			editPane = {
+				selection: pe.selection,
+				activeDraftPath: pe.activeDraftPath,
+				hidden: panelHidden
+			}
 			pe.selection = undefined
 			pe.activeDraftPath = undefined
 			panelHidden = false
 			pe.liveAnnotations = EMPTY_LIVE_ANNOTATIONS
 		}
+		// View→edit keeps what was opened in View; with only the activity feed
+		// (or nothing) showing, it reopens the pane Edit had.
+		if (m === 'edit' && mode === 'view') {
+			const openedInView = pe.selection != undefined || pe.activeDraftPath != undefined
+			if (!openedInView && editPane) {
+				const draft = editPane.activeDraftPath
+				pe.activeDraftPath = draft && pe.drafts.has(draft) ? draft : undefined
+				pe.selection = pe.activeDraftPath ? undefined : editPane.selection
+				panelHidden = editPane.hidden
+			} else if (openedInView) {
+				panelHidden = false
+			}
+			editPane = undefined
+		}
 		const url = new URL(page.url)
 		if (m === 'view') url.searchParams.delete('mode')
 		else url.searchParams.set('mode', m)
 		// Same-pathname navigation — the drafts leave-guard skips it.
-		goto(url, { replaceState: opts?.replace ?? false, keepFocus: true, noScroll: true })
+		return goto(url, { replaceState: opts?.replace ?? false, keepFocus: true, noScroll: true })
 	}
 	// View-mode drafts overlay: "what View will show once the drafts are
 	// deployed". A view variant rather than a third mode — ephemeral (not
@@ -188,17 +254,6 @@
 	// shared link couldn't reproduce it anyway).
 	let includeDrafts = $state(false)
 
-	// Asset-kind → syntax-prefix for `// on <ref>` reconstruction. Mirrors
-	// ASSET_KINDS in backend/parsers/windmill-parser/src/asset_parser.rs.
-	const ASSET_PREFIX: Record<AssetKind, string> = {
-		s3object: 's3://',
-		resource: '$res:',
-		ducklake: 'ducklake://',
-		datatable: 'datatable://',
-		volume: 'volume://',
-		dbt: 'dbt://'
-	}
-
 	// Path-input split for the insert menu: a read-only `f/<folder>/` chip
 	// on the left the user can't delete, plus an editable suffix seeded
 	// with a placeholder name.
@@ -281,75 +336,16 @@
 		}
 	}
 
-	// Only-add cache of (script_path → body content) populated lazily by
-	// `bodyFetchEffect` for every script in the current folder. We never
-	// remove entries: stale keys (renamed-away, deleted) are simply ignored
-	// at read time because the derived maps below only iterate paths that
-	// appear in the current `g.runnables`. That self-cleaning property is
-	// the whole reason for the refactor — no rename/delete cleanup needed.
-	let bodiesByPath = $state<Map<string, string>>(new Map())
-	// Sibling cache: the parsed asset usages from `inferAssets` (wasm), one
-	// pass per body. Same only-add semantics as `bodiesByPath`.
-	let inferredAssetsByPath = $state<Map<string, AssetWithAltAccessType[]>>(new Map())
-	// Bumped on folder change so an in-flight prefetch sweep stops before
-	// writing into the new folder's state.
-	let bodyFetchGen = 0
-
-	// Inferred write/read edges per script-in-graph. Derived from
-	//   (a) the open pane's live overlay (`liveBodyAssets`) — current
-	//       keystrokes for the script the user is editing right now, and
-	//   (b) the prefetched assets cache for everyone else.
-	// Iteration is gated on `graphRes.current.runnables`, so a path that
-	// gets renamed / deleted disappears from the derived map as soon as
-	// the refetch lands — no manual rekey, no phantom edges.
-	// Single pass over the graph's scripts producing both the write- and
-	// read-asset maps (they only differ by extractWrites vs extractReads over
-	// the same `liveBodyAssets`-vs-cache asset source). Split into two derives
-	// below so consumers can depend on one without invalidating on the other.
-	let inferredAssetEdges = $derived.by(() => {
-		const writes = new Map<string, Array<{ kind: AssetKind; path: string }>>()
-		const reads = new Map<string, Array<{ kind: AssetKind; path: string }>>()
-		const g = graphRes.current
-		if (!g) return { writes, reads }
-		const liveAssetsForPath = (path: string) =>
-			pe.liveBodyAssets.scriptPath === path
-				? pe.liveBodyAssets.assets
-				: inferredAssetsByPath.get(path)
-		for (const r of g.runnables) {
-			if (r.usage_kind !== 'script') continue
-			const assets = liveAssetsForPath(r.path)
-			if (!assets) continue
-			const w = extractWrites(assets)
-			if (w.length > 0) writes.set(r.path, w)
-			const rd = extractReads(assets)
-			if (rd.length > 0) reads.set(r.path, rd)
-		}
-		return { writes, reads }
-	})
-	let inferredWritesByPath = $derived(inferredAssetEdges.writes)
-	let inferredReadsByPath = $derived(inferredAssetEdges.reads)
-	// Same derived shape for `// on kafka` etc. annotations. Live buffer
-	// wins for the open script; everyone else is parsed from the
-	// prefetched body content.
-	let annotatedNativeKindsByPath = $derived.by(() => {
-		const out = new Map<string, Set<NativeTriggerKind>>()
-		const g = graphRes.current
-		if (!g) return out
-		const livePath = pe.liveAnnotations.scriptPath
-		for (const r of g.runnables) {
-			if (r.usage_kind !== 'script') continue
-			let kinds: Set<NativeTriggerKind>
-			if (r.path === livePath) {
-				kinds = new Set(pe.liveAnnotations.annotations.nativeTriggers.map((n) => n.kind))
-			} else {
-				const body = bodiesByPath.get(r.path)
-				if (!body) continue
-				kinds = new Set(parsePipelineAnnotations(body).nativeTriggers.map((n) => n.kind))
-			}
-			if (kinds.size > 0) out.set(r.path, kinds)
-		}
-		return out
+	// Bodies, inferred asset edges and `// on` annotations of every deployed
+	// script in the folder, so the graph shows the edges of scripts never opened.
+	const assetPrefetch = usePipelineAssetPrefetch({
+		getWorkspace: () => $workspaceStore,
+		getGraph: () => graphRes.current,
+		editor: pe
 	})
+	let inferredWritesByPath = $derived(assetPrefetch.inferredWritesByPath)
+	let inferredReadsByPath = $derived(assetPrefetch.inferredReadsByPath)
+	let annotatedNativeKindsByPath = $derived(assetPrefetch.annotatedNativeKindsByPath)
 
 	// Build a runnable Script from picked language / triggers / output.
 	// Delegates to the shared template generator (pipelineTemplates.ts) so
@@ -412,9 +408,10 @@
 		triggers: DraftTriggerSource[],
 		outputKind: PipelineOutputKind,
 		input?: { kind: AssetKind; path: string },
-		aiPrompt?: string
+		aiPrompt?: string,
+		options?: PipelineInsertOptions
 	) {
-		const out = autoOutputAsset(outputKind, folder, language)
+		const out = options?.outputAsset ?? autoOutputAsset(outputKind, folder, language)
 		const script = buildDraft(language, scriptPath, triggers, outputKind, out, input)
 		// Write the new draft into the map (structural update so Svelte
 		// re-derives graphWithDraft) and focus it in the details pane. When
@@ -429,6 +426,19 @@
 		pe.drafts = next
 		pe.activeDraftPath = scriptPath
 		pe.selection = undefined
+		if (options?.schedule) {
+			const path = options.schedule.path || defaultTriggerPath(scriptPath, 'schedule')
+			const saved = pe.setTriggerDraft({
+				kind: 'schedule',
+				config: { ...options.schedule, path, script_path: scriptPath }
+			})
+			if (!saved) {
+				sendUserToast(
+					`Another draft schedule already uses the path ${path}; the new script has no schedule`,
+					true
+				)
+			}
+		}
 
 		// Follow the new node with a smooth pan. The id matches the runnable
 		// node the canvas builds for a draft script (`script:<path>`).
@@ -488,10 +498,16 @@
 		getFolder: () => folder,
 		getWorkspace: () => $workspaceStore,
 		getResolvedGraph: () => graphWithDraft,
+		hasTriggerDrafts: () => pe.triggerDrafts.size > 0,
+		getTriggerDrafts: () => pe.triggerDrafts,
+		setTriggerDraft: pe.setTriggerDraft,
 		getDrafts: () => pe.drafts,
 		setDrafts: (next) => (pe.drafts = next),
 		newDraftLocalId: pe.newDraftLocalId,
-		onForgetPath: (path) => forgetPath(path),
+		onForgetPath: (path) => {
+			forgetPath(path)
+			pe.discardTriggerDraftsFor(path)
+		},
 		onShowDrafts: () => (includeDrafts = true),
 		onProposeNode: (path) => focusPipelineNode(`script:${path}`),
 		ensureEditable: () => {
@@ -513,6 +529,42 @@
 
 	onMount(() => aiChatManager.setPipelineHelpers(pipelineAiHelpers))
 
+	// The session's preview hydrates this folder's drafts from its DB bundle, so the
+	// autosave still inside its debounce has to land first.
+	async function persistDraftsForSession(): Promise<void> {
+		const workspace = $workspaceStore
+		if (!workspace) return
+		await tick()
+		const draft = { workspace, itemKind: PIPELINE_DRAFT_KIND, path: pipelineDraftPath }
+		await UserDraftDbSyncer.flush(draft)
+		// A flush resolves even when the save failed or conflicted, and the session
+		// would then open on the older drafts the server holds: stay here instead.
+		if (UserDraftDbSyncer.getConflict(draft).conflict) {
+			throw new Error('The pipeline drafts conflict with a newer version — resolve that first.')
+		}
+		const sync = UserDraftDbSyncer.getState(draft)
+		if (sync.state === 'failed') {
+			throw new Error(
+				`The pipeline drafts could not be saved: ${sync.failureMessage ?? 'unknown error'}`
+			)
+		}
+		// The drafts go with the pipeline into the session, so leaving for it is
+		// not leaving them behind.
+		bypassNavigationGuard = true
+	}
+
+	const sessionOpen: OpenInSessionSource | undefined = $derived(
+		isOperator
+			? undefined
+			: {
+					target: { kind: 'pipeline', path: folder },
+					workspaceId: $workspaceStore ?? undefined,
+					beforeOpen: persistDraftsForSession
+				}
+	)
+	// Lets the navigation rail's session switch open this pipeline, with its drafts.
+	setOpenInSessionHandoff({ source: () => sessionOpen })
+
 	// Navigation guard state. `pendingNavigationUrl` holds the URL the user
 	// tried to leave to so we can complete the navigation after they pick
 	// "Save all" or "Discard all"; `bypassNavigationGuard` is the standard
@@ -528,7 +580,7 @@
 			bypassNavigationGuard = false
 			return
 		}
-		if (pe.drafts.size === 0) return
+		if (pendingCount === 0) return
 		// `leave` covers tab close / hard reload / cross-origin nav. SvelteKit
 		// turns a cancelled leave into a browser-native "Leave site?" prompt,
 		// which we explicitly don't want — match the rest of the editors and
@@ -563,7 +615,11 @@
 		// stale active path don't bleed into the next page. localStorage
 		// is overwritten by the persist effect on the next tick.
 		pe.drafts = new Map()
+		pe.triggerDrafts = new Map()
 		pe.activeDraftPath = undefined
+		// The open pane's buffer is autosaved as a draft of the deployed script it
+		// edits, so it has to go with the drafts.
+		pe.clearLiveOverlays()
 		saveErrors = new Map()
 		const target = pendingNavigationUrl
 		leaveModalOpen = false
@@ -574,7 +630,20 @@
 		}
 	}
 
+	// Triggers start running once deployed, so leaving through "Save all" asks
+	// first, like the toolbar button, and navigates once confirmed.
+	let leaveAfterTriggerConfirm = $state(false)
 	async function leaveModalSaveAll() {
+		if (pe.triggerDrafts.size > 0) {
+			leaveModalOpen = false
+			leaveAfterTriggerConfirm = true
+			confirmTriggerDeployOpen = true
+			return
+		}
+		await saveAllAndLeave()
+	}
+
+	async function saveAllAndLeave() {
 		leaveSaving = true
 		await saveAllDrafts()
 		leaveSaving = false
@@ -582,7 +651,7 @@
 		// page so they can deal with the failures via the bar's error
 		// popover. Otherwise resume the navigation that triggered the
 		// guard.
-		if (pe.drafts.size === 0) {
+		if (pendingCount === 0) {
 			const target = pendingNavigationUrl
 			leaveModalOpen = false
 			pendingNavigationUrl = undefined
@@ -601,6 +670,8 @@
 	// are removed from the drafts map as they land.
 	let savingAll = $state(false)
 	let saveErrors = $state<Map<string, string>>(new Map())
+	// Opened by a save that fails, so the reason is on screen without a click.
+	let saveErrorsOpen = $state(false)
 
 	// Post-deploy verification: capture the cascade-relevant facts (writes +
 	// `// on` subscriptions) the resolved draft graph promises for `paths`.
@@ -620,134 +691,38 @@
 		if (msg) sendUserToast(msg, true)
 	}
 
-	async function saveDraft(path: string, draft: Draft, ws: string): Promise<void> {
-		const script = structuredClone($state.snapshot(draft.script) as Script)
-		script.schema = script.schema ?? emptySchema()
-		try {
-			const result = await inferArgs(script.language, script.content, script.schema as Schema)
-			;(script as any).auto_kind = result?.auto_kind || undefined
-			script.has_preprocessor = result?.has_preprocessor ?? false
-		} catch {
-			// Inference failures don't block deploys (the same fallback the
-			// per-pane save uses). The createScript call is the real
-			// validation gate — if the body is broken it'll reject there.
-		}
-		// Re-infer the asset lineage from the CURRENT body. The draft's
-		// `script.assets` is a snapshot that isn't refreshed on edit, so without
-		// this a renamed/removed output (e.g. an old `CREATE TABLE foo`) would
-		// be re-deployed as a phantom write edge and linger as an orphan asset.
-		// Mirrors the per-pane save, which sends live-inferred assets.
-		let assets: AssetWithAltAccessType[] = []
-		try {
-			const inferred = await inferAssets(script.language, script.content)
-			if (inferred?.status !== 'error')
-				assets = (inferred?.assets ?? []) as AssetWithAltAccessType[]
-		} catch {
-			// Same fallback as above — an unparsable body deploys with no
-			// lineage rather than the stale snapshot.
-		}
-		await ScriptService.createScript({
-			workspace: ws,
-			requestBody: {
-				...script,
-				language: script.language,
-				description: script.description ?? '',
-				// Brand-new drafts have no parent (buildDraft seeds hash as ''
-				// — treat any falsy hash as parentless, the backend rejects
-				// an empty hex string); a draft promoted from unsaved edits
-				// to a deployed script carries that script's hash and must
-				// chain off it (createScript rejects a parentless deploy to
-				// an occupied path).
-				parent_hash: script.hash ? String(script.hash) : undefined,
-				is_template: false,
-				tag: script.tag,
-				kind: script.kind as Script['kind'] | undefined,
-				lock: undefined,
-				// Freshly inferred above — overrides the stale snapshot carried
-				// by `...script`, so the deployed lineage matches the body.
-				assets: assets as any
-			}
-		})
+	// Scripts plus trigger drafts: what "Save all" deploys.
+	let pendingCount = $derived(
+		pe.drafts.size + pe.triggerDrafts.size + (pe.liveEditPath != undefined ? 1 : 0)
+	)
+	let confirmTriggerDeployOpen = $state(false)
+
+	function requestSaveAll() {
+		if (pe.triggerDrafts.size > 0) confirmTriggerDeployOpen = true
+		else void saveAllDrafts()
 	}
 
 	async function saveAllDrafts() {
-		if (!$workspaceStore || pe.drafts.size === 0 || savingAll) return
+		if (!$workspaceStore || pendingCount === 0 || savingAll) return
 		savingAll = true
-		const ws = $workspaceStore
-		// The open pane's keystrokes live in `pe.liveContent` until the pane is
-		// torn down — the drafts Map still holds the pre-edit snapshot. Deploy
-		// what the user sees: fold the live buffer into its draft (same merge
-		// the autosave bundle applies before persisting).
-		const liveContentPath =
-			pe.liveContent.scriptPath != undefined && pe.drafts.has(pe.liveContent.scriptPath)
-				? pe.liveContent.scriptPath
-				: undefined
-		const entries = [...pe.drafts.entries()].map(([path, d]) => {
-			if (path !== liveContentPath || d.script.content === pe.liveContent.content)
-				return [path, d] as [string, Draft]
-			return [path, { ...d, script: { ...d.script, content: pe.liveContent.content } }] as [
-				string,
-				Draft
-			]
-		})
 		// Snapshot what the preview promises for every draft before anything
 		// deploys — used to verify the persisted graph below.
-		const predicted = predictCascadeFacts(entries.map(([p]) => p))
-		const errors = new Map<string, string>()
-		const savedPaths: string[] = []
-		// Parallel — every createScript is independent. The backend handles
-		// its own ordering for any cross-script lock writes; we just want
-		// failures isolated per script so one bad body doesn't block the
-		// other deploys.
-		const results = await Promise.allSettled(
-			entries.map(async ([path, d]) => {
-				await saveDraft(path, d, ws)
-				return path
-			})
-		)
-		for (let i = 0; i < results.length; i++) {
-			const r = results[i]
-			const [path] = entries[i]
-			if (r.status === 'fulfilled') {
-				savedPaths.push(path)
-			} else {
-				const e: any = r.reason
-				errors.set(path, e?.body ?? e?.message ?? String(e))
-			}
-		}
-		// Drop the saved drafts from the map; failed ones stay so the user
-		// can fix them and retry. Build the new map from the still-failing
-		// entries to keep insertion order stable.
-		if (savedPaths.length > 0) {
-			const next = new Map<string, Draft>()
-			for (const [k, v] of pe.drafts) {
-				if (!savedPaths.includes(k)) next.set(k, v)
-			}
-			pe.drafts = next
-			// If the open draft just got deployed, transfer the focus to
-			// its now-persisted runnable so the pane stays on the same
-			// script the user was editing — otherwise the pane closes,
-			// the canvas re-fits, and the user has to re-find their
-			// script after every save.
-			if (pe.activeDraftPath && savedPaths.includes(pe.activeDraftPath)) {
-				pe.selection = {
-					kind: 'runnable',
-					runnable_kind: 'script',
-					path: pe.activeDraftPath
-				}
-				pe.activeDraftPath = undefined
-			}
+		const predicted = predictCascadeFacts([...pe.drafts.keys()])
+		const { savedPaths, savedTriggers, errors } = await deployPipelineDrafts(pe, $workspaceStore)
+		if (savedPaths.length > 0 || savedTriggers.length > 0) {
 			await graphRes.refetch()
 			// Verify only what actually deployed — failed drafts would
 			// otherwise false-positive as "missing" rows.
 			reportDeployDrift(new Map([...predicted].filter(([p]) => savedPaths.includes(p))))
 		}
 		saveErrors = errors
+		if (errors.size > 0) saveErrorsOpen = true
 		savingAll = false
-		if (savedPaths.length > 0 && errors.size === 0) {
-			sendUserToast(`Saved ${savedPaths.length} draft${savedPaths.length === 1 ? '' : 's'}`)
-		} else if (savedPaths.length > 0 && errors.size > 0) {
-			sendUserToast(`Saved ${savedPaths.length}, ${errors.size} failed — see details`, true)
+		const savedCount = savedPaths.length + savedTriggers.length
+		if (savedCount > 0 && errors.size === 0) {
+			sendUserToast(`Saved ${savedCount} draft${savedCount === 1 ? '' : 's'}`)
+		} else if (savedCount > 0 && errors.size > 0) {
+			sendUserToast(`Saved ${savedCount}, ${errors.size} failed — see details`, true)
 		} else if (errors.size > 0) {
 			sendUserToast(`${errors.size} draft${errors.size === 1 ? '' : 's'} failed to save`, true)
 		}
@@ -759,6 +734,7 @@
 		next.delete(path)
 		pe.drafts = next
 		forgetPath(path)
+		pe.discardTriggerDraftsFor(path)
 	}
 
 	function clearSaveError(path: string) {
@@ -768,13 +744,13 @@
 		saveErrors = next
 	}
 
-	// "This path is gone" cleanup. The three big inferred-* / annotated-*
-	// maps used to live here too, but they're now derived from
-	// `bodiesByPath` × `g.runnables` — entries for missing paths drop out
-	// implicitly when `g.runnables` no longer mentions them, so the only
-	// things left to flush are the live overlays for the open pane + the
-	// selection + per-path save errors. `bodiesByPath` keeps its entry
-	// (only-add cache, harmless if stale).
+	function forgetScriptCache(...paths: string[]) {
+		assetPrefetch.forget(...paths)
+	}
+
+	// "This path is gone" cleanup: the live overlays for the open pane, the
+	// selection and per-path save errors. The prefetched edge maps need nothing,
+	// being derived over the current graph's scripts.
 	function forgetPath(path: string) {
 		if (pe.activeDraftPath === path) pe.activeDraftPath = undefined
 		if (pe.selection?.kind === 'runnable' && pe.selection.path === path) {
@@ -801,6 +777,8 @@
 		const draft = pe.drafts.get(oldPath)
 		if (!draft) return 'Draft not found'
 		if (pe.drafts.has(newPath)) return 'Another draft already uses this path'
+		const clash = pe.retargetTriggerDrafts(oldPath, newPath)
+		if (clash) return `Its draft trigger would be renamed to ${clash}, which another draft uses`
 		const next = new Map<string, Draft>()
 		// Preserve insertion order: replace the entry at its original
 		// position so the canvas / lists don't reshuffle on rename.
@@ -902,7 +880,7 @@
 				const draft = pe.drafts.get(path)
 				if (!draft) break
 				try {
-					await saveDraft(path, draft, $workspaceStore)
+					await deployPipelineScript(draft, $workspaceStore)
 					// Archive the previously-deployed intermediate path (if
 					// any) — a double-rename otherwise leaves it as an
 					// orphan script visible on the canvas as a "deployed"
@@ -952,6 +930,7 @@
 					const nextErrors = new Map(saveErrors)
 					nextErrors.set(path, msg)
 					saveErrors = nextErrors
+					saveErrorsOpen = true
 				}
 				// Pick up the next queued rename, if any.
 				const next = state.queuedPath
@@ -1019,6 +998,7 @@
 	// template can gate them per-mode with simple ternaries — the canvas
 	// hides each affordance when its callback is undefined.
 	function handleCanvasSelect(s: AssetGraphSelection | undefined) {
+		uploadInputsPath = undefined
 		// Clicking a node while the pane is explicitly hidden is a request
 		// to see that node — unhide. Background clicks (s == undefined)
 		// keep the hidden state.
@@ -1050,9 +1030,10 @@
 		language: ScriptLang,
 		scriptPath: string,
 		outputKind: PipelineOutputKind,
-		aiPrompt?: string
+		aiPrompt?: string,
+		options?: PipelineInsertOptions
 	) {
-		const ref = `${ASSET_PREFIX[asset.kind]}${asset.path}`
+		const ref = assetRef(asset)
 		openMaterializerDraft(
 			language,
 			scriptPath,
@@ -1062,7 +1043,8 @@
 				kind: asset.kind,
 				path: asset.path
 			},
-			aiPrompt
+			aiPrompt,
+			options
 		)
 	}
 	function handleAddPipelineScript(
@@ -1070,10 +1052,307 @@
 		scriptPath: string,
 		source: { kind: NativeTriggerKind; path: string | undefined },
 		outputKind: PipelineOutputKind,
-		aiPrompt?: string
+		aiPrompt?: string,
+		options?: PipelineInsertOptions
 	) {
-		openMaterializerDraft(language, scriptPath, [source], outputKind, undefined, aiPrompt)
+		openMaterializerDraft(language, scriptPath, [source], outputKind, undefined, aiPrompt, options)
+		// A schedule was configured by the wizard itself; other row-backed kinds
+		// are configured in their own editor, as a draft of the new script.
+		if (source.kind !== 'schedule' && isDraftableTriggerKind(source.kind)) {
+			openTriggerDraft(source.kind, scriptPath)
+		}
 	}
+	// Assets-only "Delete N items": one confirmation, then the trigger and the
+	// script, each discarded if it is a draft and deleted if it is deployed.
+	let assetDeleteTarget = $state<AssetUpstreamDelete | undefined>(undefined)
+	let assetDeleteLoading = $state(false)
+	// Permanent script deletion is admin-only, as in the pane's own remove modal;
+	// everyone else archives it.
+	let canHardDeleteScripts = $derived(!!($userStore?.is_admin || $userStore?.is_super_admin))
+	async function confirmAssetUpstreamDelete() {
+		const target = assetDeleteTarget
+		const ws = $workspaceStore
+		if (!target || !ws) return
+		assetDeleteLoading = true
+		const { script, trigger } = target
+		const n = (script ? 1 : 0) + (trigger ? 1 : 0)
+		try {
+			// The script first: when it is refused, nothing else has changed.
+			if (script) await removeScript(script, ws)
+		} catch (e: any) {
+			sendUserToast(`Could not remove ${script?.path}: ${e?.body ?? e?.message ?? String(e)}`, true)
+			assetDeleteLoading = false
+			return
+		}
+		try {
+			if (trigger) {
+				const key = triggerDraftKey(trigger.kind, trigger.path)
+				if (pe.triggerDrafts.has(key)) pe.discardTriggerDraft(key)
+				if (!trigger.draft) await deleteTriggerRow(trigger.kind, trigger.path, ws)
+			}
+			sendUserToast(`Removed ${n} item${n === 1 ? '' : 's'}`)
+		} catch (e: any) {
+			sendUserToast(
+				`${script ? `Removed ${script.path}, but not its` : 'Could not remove the'} ${trigger?.kind} trigger ${trigger?.path}: ${e?.body ?? e?.message ?? String(e)}`,
+				true
+			)
+		} finally {
+			assetDeleteTarget = undefined
+			assetDeleteLoading = false
+			await graphRes.refetch()
+		}
+	}
+	async function removeScript(script: { path: string }, ws: string) {
+		const deployed = graphRes.current?.runnables.some(
+			(r) => r.path === script.path && !r.unsaved
+		)
+		if (deployed) {
+			if (canHardDeleteScripts) {
+				await ScriptService.deleteScriptByPath({ workspace: ws, path: script.path })
+			} else {
+				await ScriptService.archiveScriptByPath({ workspace: ws, path: script.path })
+			}
+		}
+		if (pe.drafts.has(script.path)) discardDraft(script.path)
+		if (deployed) {
+			pe.discardTriggerDraftsFor(script.path)
+			forgetPath(script.path)
+			forgetScriptCache(script.path)
+		}
+	}
+
+	// ===================== Fixes for misconfigured nodes =====================
+	// Rewrites a script's annotation header and keeps the result as a draft, opened
+	// so the change is in view. The pane closes first and its buffer is saved back
+	// before the content is read: saved back after the edit, it would overwrite it.
+	async function editScriptHeader(
+		path: string,
+		apply: (content: string) => string,
+		done: string
+	): Promise<boolean> {
+		const ws = $workspaceStore
+		if (!ws) return false
+		// Wait for Edit: the switch reopens Edit's set-aside pane when it lands, which
+		// would take the place of the draft opened below.
+		if (mode !== 'edit') await setMode('edit')
+		pe.selection = undefined
+		pe.activeDraftPath = undefined
+		await tick()
+		await new Promise<void>((r) => queueMicrotask(r))
+		const draft = pe.drafts.get(path)
+		let script: Script
+		try {
+			script = draft
+				? draft.script
+				: await ScriptService.getScriptByPath({ workspace: ws, path })
+		} catch (e: any) {
+			sendUserToast(`Could not open ${path}: ${e?.body ?? e?.message ?? String(e)}`, true)
+			return false
+		}
+		panelHidden = false
+		const content = apply(script.content ?? '')
+		if (content === script.content) {
+			pe.activeDraftPath = draft ? path : undefined
+			if (!draft) pe.selection = { kind: 'runnable', runnable_kind: 'script', path }
+			sendUserToast(`${path} already does that`)
+			return true
+		}
+		const next = new Map(pe.drafts)
+		next.set(path, {
+			...(draft ?? { localId: pe.promotedDraftLocalId(path) }),
+			script: { ...script, content }
+		})
+		pe.drafts = next
+		pe.activeDraftPath = path
+		sendUserToast(`${done} in ${path}. It is a draft until you save.`)
+		return true
+	}
+
+	// Edits several scripts' headers at once, after the user has seen the list: a
+	// change to one edge or node must not silently rewrite scripts they didn't pick.
+	let multiEdit = $state<{ scripts: string[]; what: string; run: () => Promise<void> } | undefined>(
+		undefined
+	)
+	function editScripts(
+		scripts: string[],
+		what: string,
+		apply: (script: string) => (content: string) => string
+	) {
+		const run = async () => {
+			for (const s of scripts) await editScriptHeader(s, apply(s), what)
+		}
+		if (scripts.length > 1) multiEdit = { scripts, what, run }
+		else void run()
+	}
+
+	const scriptName = (p: string) => p.split('/').pop() ?? p
+
+	const readsAsset = (script: string, asset: { kind: AssetKind; path: string }) =>
+		shownGraph.edges.some(
+			(e) =>
+				e.runnable_path === script &&
+				e.asset_kind === asset.kind &&
+				e.asset_path === asset.path &&
+				(e.access_type === 'r' || e.access_type === 'rw')
+		)
+	const selectScript = (path: string) => {
+		pe.activeDraftPath = pe.drafts.has(path) ? path : undefined
+		pe.selection = pe.drafts.has(path)
+			? undefined
+			: { kind: 'runnable', runnable_kind: 'script', path }
+	}
+	const selectAsset = (asset: { kind: AssetKind; path: string }) => {
+		pe.activeDraftPath = undefined
+		pe.selection = { kind: 'asset', asset_kind: asset.kind, path: asset.path }
+	}
+	const scriptLink = (path: string) => ({ text: path, onClick: () => selectScript(path) })
+	const assetLink = (asset: { kind: AssetKind; path: string }) => ({
+		text: asset.path,
+		onClick: () => selectAsset(asset)
+	})
+
+	let nodeFixes = $derived.by(() => {
+		const fixes = new Map<string, NodeFixSpec>()
+		if (isOperator) return fixes
+		for (const [path, asset] of nodeErrors.waitsOn) {
+			fixes.set(`script:${path}`, {
+				explainer: [
+					'Runs after each write to ',
+					// Not drawn when only this subscription names it: nothing to select.
+					shownGraph.edges.some(
+						(e) => e.asset_kind === asset.kind && e.asset_path === asset.path
+					)
+						? assetLink(asset)
+						: asset.path,
+					', but nothing writes it, so it never runs.'
+				],
+				actions: [
+					{
+						label: `Remove \`on ${assetRef(asset)}\``,
+						detail: `${stopListeningChangeText(asset, readsAsset(path, asset))} in ${path}; only the annotation header changes. Saved as a draft.`,
+						run: () =>
+							editScriptHeader(
+								path,
+								(c) => stopListeningToAsset(c, asset, readsAsset(path, asset)),
+								`Removed \`on ${assetRef(asset)}\``
+							)
+					},
+					{
+						label: 'Open script',
+						run: () => {
+							pe.activeDraftPath = pe.drafts.has(path) ? path : undefined
+							pe.selection = pe.drafts.has(path)
+								? undefined
+								: { kind: 'runnable', runnable_kind: 'script', path }
+						}
+					}
+				]
+			})
+		}
+		for (const [path, why] of nodeErrors.untriggered) {
+			const unsaved = displayGraph.runnables.some((r) => r.path === path && r.unsaved)
+			fixes.set(`script:${path}`, {
+				explainer: [
+					'Nothing starts ',
+					scriptLink(path),
+					why === 'no-trigger'
+						? ': it has no trigger, so it only runs by hand.'
+						: ': it only runs after writes to tables it reads, and nothing writes them, so it only runs by hand.'
+				],
+				actions: [
+					{
+						label: 'Run it on a schedule',
+						detail: `Opens the schedule setup. On create: adds \`on schedule\` in ${path}, with the schedule as a draft.`,
+						scheduleFor: {
+							script: path,
+							onSchedule: async (schedule) => {
+								// Checked first: a header saying `on schedule` with no schedule
+								// behind it would be a new error, not a fix.
+								if (pe.triggerDrafts.has(triggerDraftKey('schedule', schedule.path))) {
+									sendUserToast(
+										`Another draft schedule already uses the path ${schedule.path}`,
+										true
+									)
+									return
+								}
+								const ok = await editScriptHeader(
+									path,
+									(c) => addTriggerDirective(c, 'schedule'),
+									'Added a schedule'
+								)
+								if (!ok) return
+								if (!pe.setTriggerDraft({ kind: 'schedule', config: { ...schedule, script_path: path } })) {
+									sendUserToast(
+										`Another draft schedule already uses the path ${schedule.path}; ${path} has no schedule yet`,
+										true
+									)
+								}
+							}
+						}
+					},
+					{
+						label: 'Run it from a webhook',
+						detail: `Adds \`on webhook\` in ${path}: it runs when its webhook URL is called. Saved as a draft.`,
+						run: () =>
+							editScriptHeader(path, (c) => addTriggerDirective(c, 'webhook'), 'Added a webhook')
+					},
+					{
+						label: unsaved ? 'Discard it' : 'Remove it',
+						detail: unsaved
+							? 'Drops the draft.'
+							: 'Opens its archive or delete confirmation.',
+						run: async () => {
+							if (mode !== 'edit') await setMode('edit')
+							// The pane takes the remove request only once it is open on the
+							// script: a request made as it mounts is its starting point.
+							if (!unsaved) {
+								panelHidden = false
+								pe.activeDraftPath = undefined
+								pe.selection = { kind: 'runnable', runnable_kind: 'script', path }
+								await tick()
+							}
+							handleRunnableMenuRemove({ runnable_kind: 'script', path, unsaved })
+						}
+					}
+				]
+			})
+		}
+		for (const t of displayGraph.triggers) {
+			if (t.trigger_kind === 'asset' || !t.missing) continue
+			if (t.trigger_kind === 'webhook' || t.trigger_kind === 'data_upload') continue
+			const kind = t.trigger_kind
+			const script = t.runnable_path
+			const label = TRIGGER_NODE_STYLE[kind]?.label ?? kind
+			fixes.set(`trigger:${kind}:missing:${script}`, {
+				explainer: [
+					scriptLink(script),
+					` declares \`on ${kind}\`, but no ${label} trigger points at it, so nothing starts it that way.`
+				],
+				actions: [
+					{
+						label: `Create the ${label} trigger`,
+						detail: 'Opens its editor. It is created when you save the pipeline.',
+						run: () => {
+							if (mode !== 'edit') setMode('edit')
+							openMissingTriggerDrawer(kind, script)
+						}
+					},
+					{
+						label: `Remove \`on ${kind}\` from ${scriptName(script)}`,
+						detail: `Edits ${script}. Saved as a draft.`,
+						run: () =>
+							editScriptHeader(
+								script,
+								(c) => removeTriggerDirective(c, kind),
+								`Removed \`on ${kind}\``
+							)
+					}
+				]
+			})
+		}
+		return fixes
+	})
+
 	function handleRunnableMenuRemove(info: {
 		runnable_kind: 'script' | 'flow'
 		path: string
@@ -1227,7 +1506,8 @@
 			liveAnnotations: pe.liveAnnotations,
 			inferredWritesByPath,
 			inferredReadsByPath,
-			annotatedNativeKindsByPath
+			annotatedNativeKindsByPath,
+			triggerDrafts: pe.triggerDrafts.values()
 		})
 	)
 
@@ -1250,7 +1530,166 @@
 	// What the canvas renders: drafts merged in edit, deployed-only in view —
 	// unless the "show drafts" chip is on, which overlays the drafts onto the
 	// view (what View will show once they're deployed).
-	let displayGraph = $derived(mode === 'edit' || includeDrafts ? graphWithDraft : deployedGraph)
+	let shownGraph = $derived(mode === 'edit' || includeDrafts ? graphWithDraft : deployedGraph)
+	// Each script's explicit `// on <asset>` subscriptions, from its live buffer,
+	// draft or deployed body.
+	let explicitOnByPath = $derived.by(() => {
+		const showDrafts = mode === 'edit' || includeDrafts
+		const out = new Map<string, Array<{ kind: AssetKind; path: string }>>()
+		for (const r of shownGraph.runnables) {
+			if (r.usage_kind !== 'script') continue
+			const live =
+				showDrafts && pe.liveAnnotations.scriptPath === r.path ? pe.liveAnnotations : undefined
+			const content = showDrafts ? pe.drafts.get(r.path)?.script.content : undefined
+			const body = content ?? assetPrefetch.bodies.get(r.path)
+			const refs = live
+				? live.annotations.triggerAssets
+				: body !== undefined
+					? parsePipelineAnnotations(body).triggerAssets
+					: []
+			if (refs.length > 0) out.set(r.path, refs)
+		}
+		return out
+	})
+	// Assets an asset trigger waits on (explicit `on`, or an auto-triggering read)
+	// that nothing in the pipeline writes, checked against the whole workspace: an
+	// asset trigger fires on a write from anywhere.
+	// Every other asset nothing in the pipeline writes is looked up too, so an
+	// asset nothing writes anywhere can go without the "add downstream step" +.
+	let writtenInPipeline = $derived(
+		new Set(
+			shownGraph.edges
+				.filter(
+					(e) =>
+						e.runnable_kind === 'script' && (e.access_type === 'w' || e.access_type === 'rw')
+				)
+				.map((e) => `${e.asset_kind}:${e.asset_path}`)
+		)
+	)
+	// dbt builds its models; its sources come from elsewhere, like any other asset.
+	const dbtBuilt = (a: { dbt?: { resource_type?: string } | null }) =>
+		!!a.dbt && a.dbt.resource_type !== 'source'
+	let unwrittenInPipeline = $derived(
+		[
+			...new Set([
+				...pipelineNodeErrors(shownGraph, explicitOnByPath).unwrittenTriggerAssets,
+				...shownGraph.assets
+					.filter((a) => !dbtBuilt(a) && !writtenInPipeline.has(`${a.kind}:${a.path}`))
+					.map((a) => `${a.kind}:${a.path}`)
+			])
+		]
+			.sort()
+			.join('\n')
+	)
+	// Whether a script outside the pipeline writes each asset (a flow's write fires
+	// no asset trigger). One lookup per asset, bounded, and remembered per
+	// `kind:path` so editing the graph only asks about assets it has not seen.
+	const writerLookups = new Map<string, Promise<boolean | undefined>>()
+	const writerLimit = pLimit(6)
+	function writtenInWorkspace(ws: string, key: string): Promise<boolean | undefined> {
+		const cacheKey = `${ws}\n${key}`
+		let p = writerLookups.get(cacheKey)
+		if (!p) {
+			const i = key.indexOf(':')
+			const kind = key.slice(0, i)
+			const path = key.slice(i + 1)
+			p = writerLimit(async () => {
+				try {
+					const res = await AssetService.listAssets({ workspace: ws, path, assetKinds: kind })
+					return res.assets.some((a) =>
+						a.usages.some(
+							(u) => u.kind === 'script' && (u.access_type === 'w' || u.access_type === 'rw')
+						)
+					)
+				} catch {
+					// Unknown: the node stays flagged, and the next graph change asks again.
+					writerLookups.delete(cacheKey)
+					return undefined
+				}
+			})
+			writerLookups.set(cacheKey, p)
+		}
+		return p
+	}
+	let writtenElsewhere = resource(
+		[() => $workspaceStore, () => unwrittenInPipeline],
+		async ([ws, keys]) => {
+			const out = new Set<string>()
+			if (!ws || !keys) return out
+			const list = keys.split('\n')
+			const found = await Promise.all(list.map((key) => writtenInWorkspace(ws, key)))
+			list.forEach((key, i) => found[i] && out.add(key))
+			return out
+		}
+	)
+	// Until the lookup answers for the assets it is asking about, they count as
+	// written: a node turns red only once nothing is known to write them, never
+	// for the moment the answer is in flight.
+	let nodeErrors = $derived.by(() => {
+		const errors = pipelineNodeErrors(
+			shownGraph,
+			explicitOnByPath,
+			writtenElsewhere.loading || !writtenElsewhere.current
+				? new Set([...(writtenElsewhere.current ?? []), ...unwrittenInPipeline.split('\n')])
+				: writtenElsewhere.current
+		)
+		// A webhook or data upload trigger is read from the script's body, which loads
+		// after the graph: until it has, "nothing starts it" may only mean "not read yet".
+		for (const path of [...errors.untriggered.keys()]) {
+			if (pe.drafts.has(path) || assetPrefetch.bodies.has(path)) continue
+			errors.untriggered.delete(path)
+			errors.scripts.delete(path)
+		}
+		return errors
+	})
+	let displayGraph = $derived(withSummaries(shownGraph))
+	// Adds what the canvas shows but the resolved graph does not carry: script
+	// summaries and languages, schedule crons, and which nodes are misconfigured.
+	function withSummaries(g: AssetGraphResponse): AssetGraphResponse {
+		const showDrafts = mode === 'edit' || includeDrafts
+		const errors = nodeErrors
+		const schedules = scheduleInfo.current
+		// An asset drawn only because a script subscribes to it, which nothing ever
+		// writes, stands for nothing: it is left out, and the subscriber carries the
+		// error. One a script reads or writes stays.
+		const used = new Set(g.edges.map((e) => `${e.asset_kind}:${e.asset_path}`))
+		const phantom = new Set([...errors.unwritten.keys()].filter((k) => !used.has(k)))
+		const triggers = g.triggers.filter(
+			(t) => t.trigger_kind !== 'asset' || !phantom.has(`${t.asset_kind}:${t.asset_path}`)
+		)
+		return {
+			...g,
+			triggers: schedules?.size
+				? triggers.map((t) =>
+						t.trigger_kind === 'schedule' && t.path && !t.draft && schedules.has(t.path)
+							? { ...t, ...schedules.get(t.path) }
+							: t
+					)
+				: triggers,
+			assets: g.assets
+				.filter((a) => !phantom.has(`${a.kind}:${a.path}`))
+				.map((a) => {
+					const key = `${a.kind}:${a.path}`
+					const error = errors.assets.get(key)
+					// Only once the workspace lookup has answered: before, it is unknown.
+					const never_written =
+						!dbtBuilt(a) &&
+						!writtenInPipeline.has(key) &&
+						!!writtenElsewhere.current &&
+						!writtenElsewhere.loading &&
+						!writtenElsewhere.current.has(key)
+					return error || never_written ? { ...a, error, never_written } : a
+				}),
+			runnables: g.runnables.map((r) => {
+				const draft = showDrafts ? pe.drafts.get(r.path)?.script : undefined
+				const meta = assetPrefetch.scriptMeta.get(r.path)
+				const summary = draft?.summary || meta?.summary
+				const language = draft?.language ?? meta?.language
+				const error = r.usage_kind === 'script' ? errors.scripts.get(r.path) : undefined
+				return summary || language || error ? { ...r, summary, language, error } : r
+			})
+		}
+	}
 
 	// Leaving edit mode: drop the live editor overlays — they substitute the
 	// last keystroke buffer for one script inside inferredWritesByPath /
@@ -1486,7 +1925,7 @@
 	// data_upload) receives its input from the live event or request at dispatch
 	// time — a message, an HTTP body, an uploaded file — which doesn't exist
 	// during a manual run, so there's nothing to default and those scripts run
-	// empty (data_upload being fed its staged file instead, see dataUploadArgs).
+	// empty (data_upload being fed its staged file instead, see dataUploads).
 	// Resolved on demand right before a run (schedule args aren't in the graph
 	// response); fail-safe — a schedule we can't fetch just contributes nothing.
 	let scheduleArgsByPath: Record<string, Record<string, any>> = {}
@@ -1532,7 +1971,7 @@
 		// data-upload entry's staged file override. runWholePipeline already
 		// refused to start unless every data-upload entry is staged, so this is
 		// always the intended input.
-		const staged = { ...(scheduleArgsByPath[path] ?? {}), ...(dataUploadArgs[path]?.args ?? {}) }
+		const staged = { ...(scheduleArgsByPath[path] ?? {}), ...(dataUploads.argsFor(path) ?? {}) }
 		const draft = mode === 'edit' || includeDrafts ? pe.drafts.get(path) : undefined
 		if (draft) {
 			if (!draft.script.content || !draft.script.language) {
@@ -1848,70 +2287,8 @@
 		}
 	}
 
-	// Staged run-form input for data-upload entry scripts, keyed by path. Lifted
-	// out of the (transient, per-selection) run form so the uploaded/entered data
-	// persists across selection changes — it drives each entry node's green
-	// "ready" state and seeds the whole-pipeline run with that input. `valid` is
-	// the run form's full-schema validity (all required fields satisfied).
-	let dataUploadArgs = $state<Record<string, { args: Record<string, any>; valid: boolean }>>({})
-
-	// An S3Object-shaped value (the file picker writes `{ s3: '<path>' }`).
-	function isS3Object(v: any): boolean {
-		return !!v && typeof v === 'object' && !Array.isArray(v) && 's3' in v
-	}
-	// Whether a staged value carries actual data. Covers the two shapes a
-	// data-upload entry takes: an S3Object (file picker → `{ s3: '<path>' }`) and
-	// a plain required input (e.g. a JSON array pasted into the run form).
-	function hasMeaningfulValue(v: any): boolean {
-		if (v == null) return false
-		if (typeof v === 'string') return v.length > 0
-		if (Array.isArray(v)) return v.length > 0
-		if (typeof v === 'object')
-			return isS3Object(v) ? typeof v.s3 === 'string' && v.s3.length > 0 : Object.keys(v).length > 0
-		return true // numbers / booleans count as provided
-	}
-	// A data-upload entry is ready once the user actually provided its data, not
-	// just opened the form. Two guards: the form's own full-schema `valid` (every
-	// required field — including non-file ones — is satisfied), AND that any
-	// declared S3Object file field actually carries a file (the picker can leave
-	// an empty `{ s3: '' }` on a non-required file field, which `valid` alone
-	// wouldn't catch).
-	function dataUploadReady(path: string): boolean {
-		const staged = dataUploadArgs[path]
-		if (!staged || !staged.valid) return false
-		const values = Object.values(staged.args)
-		const s3s = values.filter(isS3Object)
-		if (s3s.length > 0) return s3s.every(hasMeaningfulValue)
-		return values.some(hasMeaningfulValue)
-	}
-	// Persist the run form's args + validity, but only for data-upload entries —
-	// other run forms (partitioned producers) run their own way and must not be
-	// mistaken for a staged upload. Idempotent: the run form re-emits on every
-	// keystroke/validation pass, so bail when the value is unchanged — otherwise
-	// each emit would reassign `dataUploadArgs`, giving `readyDataUploadPaths` a
-	// fresh Set identity that re-syncs the canvas and re-fires the form's emit
-	// effect (effect_update_depth_exceeded).
-	function stageRunFormArgs(path: string, args: Record<string, any>, valid: boolean) {
-		if (!dataUploadEntryPaths.has(path)) return
-		const prev = dataUploadArgs[path]
-		if (prev && prev.valid === valid && JSON.stringify(prev.args) === JSON.stringify(args)) return
-		dataUploadArgs = { ...dataUploadArgs, [path]: { args, valid } }
-	}
-	// Pipeline scripts that are data-upload entry points (a `data_upload` trigger
-	// in the displayed graph). They can't auto-run — they need an uploaded file
-	// before the pipeline can go (see runWholePipeline's gate + the node's green
-	// state).
-	let dataUploadEntryPaths = $derived(
-		new Set(
-			displayGraph.triggers
-				.filter((t) => t.trigger_kind === 'data_upload' && t.runnable_kind === 'script')
-				.map((t) => t.runnable_path)
-		)
-	)
-	// Of those, the ones with a staged file — drives the green node treatment.
-	let readyDataUploadPaths = $derived(
-		new Set([...dataUploadEntryPaths].filter((p) => dataUploadReady(p)))
-	)
+	// Data-upload entries' staged input; see usePipelineDataUploads.
+	const dataUploads = usePipelineDataUploads(() => displayGraph)
 
 	// Every pipeline-member script, for the always-visible header "Run pipeline"
 	// control. Per-node runs are hover/select-gated on the canvas; this
@@ -1934,7 +2311,7 @@
 		// point the user at the first unready node instead of launching a doomed
 		// run.
 		const unready = allPipelineScripts.filter(
-			(p) => dataUploadEntryPaths.has(p) && !dataUploadReady(p)
+			(p) => dataUploads.entryPaths.has(p) && !dataUploads.isReady(p)
 		)
 		if (unready.length > 0) {
 			sendUserToast(
@@ -2141,7 +2518,52 @@
 	// auto-generated run form (the script declares an `S3Object` input, so the
 	// form renders the S3 picker) lets the user upload a file and run the
 	// pipeline. Drafts open in-place too so the user can fill the body first.
+	// A data-upload click opens the node on its inputs alone; any other selection
+	// (or "Open script") goes back to the script.
+	let uploadInputsPath = $state<string | undefined>(undefined)
+	// Runs the open node with its form inputs: a draft previews its own content, a
+	// deployed script runs for real (in view mode, cascading like any legit run).
+	// `live` is the pane's buffer when it differs from what is stored (a draft, or a
+	// deployed node edited before switching to the inputs view): it is previewed.
+	async function runUploadInputs(
+		path: string,
+		args: Record<string, any>,
+		live?: { content: string; language: ScriptLang }
+	): Promise<string | undefined> {
+		const draft = mode === 'edit' ? pe.drafts.get(path) : undefined
+		const body =
+			mode === 'edit'
+				? (live ?? (draft && { content: draft.script.content, language: draft.script.language }))
+				: undefined
+		if (!body) return mode === 'edit' ? runDeployedWithArgs(path, args) : runByPathLegit(path, args)
+		if (!$workspaceStore || !body.content || !body.language) return undefined
+		activeRunnables.arm(`script:${path}`)
+		try {
+			const jobId = await JobService.runScriptPreview({
+				workspace: $workspaceStore,
+				requestBody: {
+					content: body.content,
+					language: body.language,
+					path,
+					args: { ...args, _wmill_skip_asset_dispatch: true }
+				}
+			})
+			runsPendingJobId = jobId
+			runsRefreshKey++
+			activeRunnable = { kind: 'script', path }
+			activeRunnableJobId = jobId
+			return jobId
+		} catch (e: any) {
+			sendUserToast(`Run failed: ${e?.body ?? e?.message ?? e}`, true)
+			return undefined
+		}
+	}
+	// Same as a canvas run of a deployed node in edit mode: this step only.
+	function runDeployedWithArgs(path: string, args: Record<string, any>) {
+		return runByPathLegit(path, { ...args, _wmill_skip_asset_dispatch: true })
+	}
 	function openDataUploadRun(scriptPath: string) {
+		uploadInputsPath = scriptPath
 		// Opening the run form is meaningless while the pane is hidden —
 		// unhide first, same as a plain node click.
 		panelHidden = false
@@ -2168,6 +2590,12 @@
 		// time or silently bind to nothing. Surface that as a toast and
 		// keep the drawer closed; the user needs to save the script first
 		// (which also creates it under the new path if they renamed it).
+		// Kinds with a trigger row can instead wait as a pipeline draft and
+		// deploy with the pipeline, after the script.
+		if (isDraftableTriggerKind(kind) && pe.drafts.has(scriptPath)) {
+			openTriggerDraft(kind, scriptPath)
+			return
+		}
 		if (pe.drafts.has(scriptPath)) {
 			sendUserToast(
 				`Save the script "${scriptPath}" first — triggers can only be attached to deployed scripts.`,
@@ -2183,13 +2611,42 @@
 	// can still be edited everywhere else (TriggersPanel, etc.) where the
 	// picker stays editable.
 	function deleteAttachedTrigger(kind: NativeTriggerKind, triggerPath: string) {
+		const key = triggerDraftKey(kind, triggerPath)
+		if (pe.triggerDrafts.has(key)) {
+			pe.discardTriggerDraft(key)
+			return
+		}
 		triggerEditors?.requestDelete(kind, triggerPath)
 	}
 
 	function openEditTriggerDrawer(kind: NativeTriggerKind, triggerPath: string, scriptPath: string) {
+		const draft = pe.triggerDrafts.get(triggerDraftKey(kind, triggerPath))
+		if (draft) {
+			openTriggerDraft(draft.kind, scriptPath, draft)
+			return
+		}
 		triggerEditors?.openEdit(kind, triggerPath, scriptPath)
 	}
 
+	/** The kind's editor over a new draft, or over `draft` when re-editing one. */
+	function openTriggerDraft(
+		kind: PipelineTriggerDraftKind,
+		scriptPath: string,
+		draft?: PipelineTriggerDraft
+	) {
+		const defaults = { path: defaultTriggerPath(scriptPath, kind) }
+		triggerEditors?.openTriggerDraft(kind, scriptPath, defaults, draft?.config, (cfg) => {
+			const { extra_perms: _, ...config } = cfg
+			const saved = pe.setTriggerDraft(
+				{ kind, config: { ...config, path: cfg.path, script_path: scriptPath, is_flow: false } },
+				// The editor's Path field can rename it; drafts are keyed by path.
+				draft ? triggerDraftKey(kind, draft.config.path) : undefined
+			)
+			if (!saved) sendUserToast(`Another draft trigger already uses the path ${cfg.path}`, true)
+			return saved
+		})
+	}
+
 	// Reuse the empty AssetGraphResponse so we can still render the canvas
 	// (layout, controls, mini-map) on a fresh pipeline.
 	const EMPTY_GRAPH: AssetGraphResponse = {
@@ -2277,6 +2734,35 @@
 		}
 	)
 
+	// Cron, zone and summary of the deployed schedules on the graph, for their nodes'
+	// labels. Re-read with every graph load, so an edit in the schedule drawer shows.
+	let scheduleInfo = resource(
+		[() => $workspaceStore, () => graphRes.current],
+		async ([ws, g]) => {
+			const info = new Map<string, { schedule: string; timezone: string; summary?: string }>()
+			if (!ws || !g) return info
+			const paths = new Set<string>()
+			for (const t of g.triggers) {
+				if (t.trigger_kind === 'schedule' && t.path && !t.missing) paths.add(t.path)
+			}
+			await Promise.all(
+				[...paths].map(async (path) => {
+					try {
+						const s = await ScheduleService.getSchedule({ workspace: ws, path })
+						info.set(path, {
+							schedule: s.schedule,
+							timezone: s.timezone,
+							summary: s.summary || undefined
+						})
+					} catch {
+						// Unreadable schedule: its node keeps the plain "Schedule" label.
+					}
+				})
+			)
+			return info
+		}
+	)
+
 	// Folder whose graph is actually rendered. `graphRes.current` is stale-
 	// while-revalidate on an in-place folder switch, so keying the canvas's
 	// one-shot initial fit on the route param would fire the new folder's fit
@@ -2287,64 +2773,6 @@
 		if (graphRes.current) untrack(() => (viewportFitFolder = folder))
 	})
 
-	// Body / inferred-assets prefetch sweep. Watches `g.runnables`; for any
-	// non-draft path we haven't fetched yet, fetches `getScriptByPath` and
-	// `inferAssets`, and stores both in their respective only-add caches.
-	// All three previously-sticky maps (`inferredWritesByPath`,
-	// `inferredReadsByPath`, `annotatedNativeKindsByPath`) are now derived
-	// from these caches × the current graph, so rename / delete cleanup
-	// happens implicitly when `g.runnables` changes — no per-mutation
-	// cache surgery needed. A generation counter cancels in-flight work on
-	// folder change so the previous folder's results never leak into the
-	// new one.
-	let prefetchingAssets = $state(false)
-	$effect(() => {
-		const ws = $workspaceStore
-		const g = graphRes.current
-		if (!ws || !g) return
-		const gen = ++bodyFetchGen
-		const targets = untrack(() =>
-			g.runnables
-				.filter((r) => r.usage_kind === 'script')
-				.map((r) => r.path)
-				.filter((p) => !pe.drafts.has(p) && !bodiesByPath.has(p))
-		)
-		if (targets.length === 0) return
-		let i = 0
-		const POOL = 6
-		const worker = async () => {
-			while (i < targets.length && gen === bodyFetchGen) {
-				const path = targets[i++]
-				try {
-					const s = await ScriptService.getScriptByPath({ workspace: ws, path })
-					if (gen !== bodyFetchGen) return
-					const content = s.content ?? ''
-					const res = await inferAssets(s.language, content)
-					if (gen !== bodyFetchGen) return
-					const inferred = (res?.assets ?? []) as AssetWithAltAccessType[]
-					untrack(() => {
-						if (!bodiesByPath.has(path)) {
-							const nextBodies = new Map(bodiesByPath)
-							nextBodies.set(path, content)
-							bodiesByPath = nextBodies
-						}
-						if (!inferredAssetsByPath.has(path)) {
-							const nextAssets = new Map(inferredAssetsByPath)
-							nextAssets.set(path, inferred)
-							inferredAssetsByPath = nextAssets
-						}
-					})
-				} catch {
-					// Skip — that node just falls back to base-graph edges.
-				}
-			}
-		}
-		prefetchingAssets = true
-		const pool = Array.from({ length: Math.min(POOL, targets.length) }, () => worker())
-		void Promise.all(pool).then(() => {
-			if (gen === bodyFetchGen) prefetchingAssets = false
-		})
-	})
 
 	function pluralize(n: number, singular: string): string {
 		return `${n} ${singular}${n === 1 ? '' : 's'}`
@@ -2386,81 +2814,92 @@
 	<title>Pipeline · {folder} — Windmill</title>
 </svelte:head>
 
-<div class="flex flex-col h-full">
+<PageHeaderContent
+	section={{ label: 'Pipelines', content: pipelineCrumb }}
+	actions={pipelineActions}
+	actionsFlexible
+/>
+
+{#snippet pipelineCrumb()}
+	<a
+		href="{base}/pipeline"
+		class="flex items-center gap-1 px-1 py-0.5 rounded text-xs text-primary hover:bg-surface-hover hover:text-emphasis transition-colors"
+	>
+		<NetworkIcon size={14} class="shrink-0 text-tertiary" />
+		Pipelines
+	</a>
+	<span class="shrink-0 text-hint/40 text-xs" aria-hidden="true">/</span>
+	{#snippet folderSegment()}
+		<span
+			class="flex items-center gap-1 px-1 py-0.5 rounded text-xs text-primary hover:bg-surface-hover hover:text-emphasis transition-colors"
+			title="Switch pipeline folder"
+		>
+			<Folder size={14} class="shrink-0 text-tertiary" />
+			<span class="truncate font-normal">{folder}</span>
+			<ChevronDown size={14} class="shrink-0 text-tertiary" />
+		</span>
+	{/snippet}
+	{#if otherPipelineFolders.length === 0}
+		<button type="button" onclick={() => (pickerModalOpen = true)}>
+			{@render folderSegment()}
+		</button>
+	{:else}
+		<DropdownV2 size="sm" items={folderSwitcherItems}>
+			{#snippet buttonReplacement()}
+				{@render folderSegment()}
+			{/snippet}
+		</DropdownV2>
+	{/if}
+	{#if summary.length > 0}
+		<span class="text-2xs text-secondary truncate">{summary.join(' · ')}</span>
+	{/if}
+	{#if mode === 'edit' && $workspaceStore}
+		<!-- Draft sync for the whole pipeline bundle, beside its name like a flow's.
+		     Distinct from "Save all", which deploys the drafts. -->
+		<AutosaveIndicator
+			workspace={$workspaceStore}
+			itemKind={PIPELINE_DRAFT_KIND}
+			path={pipelineDraftPath}
+			draftOnly
+			loadedFromDraft={pe.loadedFromDbDraft}
+		/>
+	{/if}
+{/snippet}
+
+{#snippet pipelineActions()}
+	<!-- This page carries more actions than any other in the band, so the set scrolls rather than
+	     being pushed off the end. `actionsFlexible` on the registration is what lets this box
+	     shrink far enough for that to matter. -->
 	<div
-		class="border-b flex flex-row justify-between gap-2 px-2 py-1 items-center overflow-y-visible overflow-x-auto min-h-12 shrink-0 whitespace-nowrap"
+		class="flex flex-row items-center gap-2 min-w-0 overflow-x-auto scrollbar-hidden whitespace-nowrap"
 	>
-		<div class="flex flex-row items-center gap-2 flex-1 min-w-0">
-			<Button
-				variant="subtle"
-				unifiedSize="sm"
-				href="{base}/pipeline"
-				startIcon={{ icon: ArrowLeft }}
-				iconOnly
-				title="Back to pipelines"
-			/>
-			<NetworkIcon size={16} class="text-tertiary shrink-0" />
-			<h1 class="text-sm font-semibold">{mode === 'edit' ? 'Pipeline editor' : 'Pipeline'}</h1>
-			<span class="text-tertiary text-sm">·</span>
-			{#if otherPipelineFolders.length === 0}
-				<button
-					type="button"
-					onclick={() => (pickerModalOpen = true)}
-					class="flex items-center gap-1.5 px-2.5 py-1 rounded-md border border-gray-300 dark:border-gray-600 bg-surface hover:bg-surface-hover transition-colors"
-					title="Switch pipeline folder"
-				>
-					<Folder size={14} class="text-tertiary shrink-0" />
-					<span class="text-sm font-mono font-medium text-emphasis">f/{folder}</span>
-					<ChevronDown size={12} class="text-tertiary" />
-				</button>
-			{:else}
-				<DropdownV2 size="sm" items={folderSwitcherItems}>
-					{#snippet buttonReplacement()}
-						<span
-							class="flex items-center gap-1.5 px-2.5 py-1 rounded-md border border-gray-300 dark:border-gray-600 bg-surface hover:bg-surface-hover transition-colors"
-							title="Switch pipeline folder"
-						>
-							<Folder size={14} class="text-tertiary shrink-0" />
-							<span class="text-sm font-mono font-medium text-emphasis">f/{folder}</span>
-							<ChevronDown size={12} class="text-tertiary" />
-						</span>
-					{/snippet}
-				</DropdownV2>
-			{/if}
-			{#if summary.length > 0}
-				<span class="text-xs text-tertiary">· {summary.join(' · ')}</span>
-			{/if}
-		</div>
 		{#if !isOperator}
 			<!-- Center group: the mode toggle is the page's primary control —
 			     anchored between the two flex-1 side groups so it stays
 			     centered, with breathing room on both sides. -->
-			<div class="flex flex-row items-center gap-2 shrink-0 px-6">
-				<PipelineModeToggle {mode} draftCount={pe.drafts.size} onModeChange={(m) => setMode(m)} />
-				{#if mode === 'view' && pe.drafts.size > 0}
+			<div class="flex flex-row items-center gap-2 shrink-0">
+				<PipelineModeToggle {mode} draftCount={pendingCount} onModeChange={(m) => setMode(m)} />
+				{#if mode === 'view' && pendingCount > 0}
 					<!-- View variant: overlay the unsaved drafts onto the deployed
 					     graph — "what View will show once they're deployed". -->
-					<button
-						type="button"
+					<Button
+						variant="default"
+						unifiedSize="sm"
+						startIcon={{ icon: Telescope }}
 						onclick={() => (includeDrafts = !includeDrafts)}
-						class={twMerge(
-							'flex items-center gap-1.5 px-2.5 py-1 rounded-md border text-xs font-medium transition-colors',
-							includeDrafts
-								? 'bg-amber-50 dark:bg-amber-900/30 border-amber-300 dark:border-amber-700 text-amber-700 dark:text-amber-400'
-								: 'bg-surface border-gray-300 dark:border-gray-600 text-secondary hover:bg-surface-hover'
-						)}
+						btnClasses={includeDrafts
+							? '!bg-amber-50 dark:!bg-amber-900/30 !border-amber-300 dark:!border-amber-700 !text-amber-700 dark:!text-amber-400'
+							: undefined}
 						title={includeDrafts
 							? 'Showing undeployed drafts overlaid on the deployed pipeline — click to hide them'
 							: 'Overlay your undeployed drafts to see what the pipeline will look like once deployed'}
 					>
-						<Telescope size={14} />
 						{includeDrafts ? 'Showing' : 'Show'}
-						{pe.drafts.size} draft{pe.drafts.size === 1 ? '' : 's'}
-					</button>
+						{pendingCount} draft{pendingCount === 1 ? '' : 's'}
+					</Button>
 				{/if}
 			</div>
 		{/if}
-		<div class="flex flex-row items-center gap-2 flex-1 justify-end">
 			{#if !isOperator && allPipelineScripts.length > 0}
 				<!-- Only the armed state surfaces on the bar (arming lives in the ⋮
 				     menu) — a compact disarm pill. -->
@@ -2500,61 +2939,18 @@
 				</Button>
 			{/if}
 			{#if mode === 'edit' && saveErrors.size > 0}
-				<!-- Compact errors popover anchored next to Save all so users
-				     can see exactly which drafts failed and why without losing
-				     the editor context. Drafts that succeed disappear from
-				     the map; the ones still listed here are the unresolved
-				     failures. -->
-				<Popover placement="bottom-end" contentClasses="p-3 max-w-[480px]" usePointerDownOutside>
-					{#snippet trigger()}
-						<button
-							type="button"
-							class="flex items-center gap-1.5 px-2 py-1 rounded-md text-red-600 dark:text-red-400 bg-red-50 dark:bg-red-900/30 hover:bg-red-100 dark:hover:bg-red-900/50 transition-colors text-xs font-medium"
-							title="View save errors"
-						>
-							<AlertTriangle size={14} />
-							<span>{saveErrors.size} failed</span>
-						</button>
-					{/snippet}
-					{#snippet content()}
-						<div class="flex flex-col gap-2">
-							<span class="text-xs font-semibold text-emphasis">Save errors</span>
-							<div class="flex flex-col gap-2 max-h-72 overflow-y-auto">
-								{#each [...saveErrors.entries()] as [path, message]}
-									<div class="flex flex-col gap-0.5 border-l-2 border-red-400 pl-2">
-										<span class="text-2xs font-mono text-emphasis">{path}</span>
-										<span class="text-2xs text-red-600 dark:text-red-400 break-words">
-											{message}
-										</span>
-									</div>
-								{/each}
-							</div>
-						</div>
-					{/snippet}
-				</Popover>
+				<PipelineDeployErrors errors={saveErrors} bind:open={saveErrorsOpen} />
 			{/if}
-			{#if mode === 'edit' && pe.drafts.size > 0}
-				<!-- Draft autosave status for the whole pipeline bundle. Distinct
-				     from "Save all", which DEPLOYS the drafts — this only reflects
-				     that in-flight edits are persisted to the per-user server draft. -->
-				{#if $workspaceStore}
-					<AutosaveIndicator
-						workspace={$workspaceStore}
-						itemKind={PIPELINE_DRAFT_KIND}
-						path={pipelineDraftPath}
-						draftOnly
-						loadedFromDraft={pe.loadedFromDbDraft}
-					/>
-				{/if}
+			{#if mode === 'edit' && pendingCount > 0}
 				<Button
 					variant="accent"
 					unifiedSize="sm"
 					startIcon={{ icon: savingAll ? Loader2 : Save }}
-					onclick={saveAllDrafts}
+					onclick={requestSaveAll}
 					disabled={savingAll}
-					title={savingAll ? 'Saving drafts…' : `Deploy all ${pe.drafts.size} drafts`}
+					title={savingAll ? 'Saving drafts…' : `Deploy all ${pendingCount} drafts`}
 				>
-					{savingAll ? 'Saving…' : `Save all (${pe.drafts.size})`}
+					{savingAll ? 'Saving…' : `Save all (${pendingCount})`}
 				</Button>
 			{/if}
 			{#if mode === 'view'}
@@ -2570,6 +2966,7 @@
 					Activity
 				</Button>
 			{/if}
+			<OpenInSessionButton source={sessionOpen} />
 			<Button
 				variant="subtle"
 				unifiedSize="sm"
@@ -2580,9 +2977,10 @@
 				title="Refresh"
 			/>
 			<DropdownV2 size="sm" items={overflowMenuItems} />
-		</div>
 	</div>
+{/snippet}
 
+<div class="flex flex-col h-full">
 	<div class="flex-1 min-h-0">
 		{#if graphRes.loading && !graphRes.current}
 			<div class="h-full flex items-center justify-center gap-2 text-tertiary">
@@ -2606,7 +3004,7 @@
 				defaultPathSuffix={DEFAULT_PATH_SUFFIX}
 				{panelHidden}
 				onTogglePanelHidden={() => (panelHidden = !panelHidden)}
-				{prefetchingAssets}
+				prefetchingAssets={assetPrefetch.prefetching}
 				hoveredPaths={activityHoverPaths}
 				selectedRunPaths={activitySelectPaths}
 				{activeRunnable}
@@ -2625,13 +3023,59 @@
 				onDeleteTrigger={mode === 'edit' ? deleteAttachedTrigger : undefined}
 				onOpenWebhook={openWebhookDrawer}
 				onOpenDataUpload={openDataUploadRun}
-				{readyDataUploadPaths}
-				runFormInitialArgs={openScriptPath ? dataUploadArgs[openScriptPath]?.args : undefined}
-				onRunFormArgsChange={stageRunFormArgs}
+				readyDataUploadPaths={dataUploads.readyPaths}
+				runFormInitialArgs={openScriptPath ? dataUploads.argsFor(openScriptPath) : undefined}
+				onRunFormArgsChange={dataUploads.stage}
+				inputsOnly={uploadInputsPath !== undefined &&
+					(openScriptPath === undefined || uploadInputsPath === openScriptPath)}
+				onRunInputs={runUploadInputs}
+				onShowScript={() => (uploadInputsPath = undefined)}
 				onSelect={handleCanvasSelect}
 				onAddScriptForAsset={mode === 'edit' ? handleAddScriptForAsset : undefined}
 				onAddPipelineScript={mode === 'edit' ? handleAddPipelineScript : undefined}
 				onRunnableMenuRemove={mode === 'edit' ? handleRunnableMenuRemove : undefined}
+				onDeleteAssetUpstream={isOperator ? undefined : (t) => (assetDeleteTarget = t)}
+				{nodeFixes}
+				assetDeleteVerb={canHardDeleteScripts ? 'Delete' : 'Archive'}
+				onEdgeAction={isOperator
+					? undefined
+					: ({
+							action,
+							targets
+						}: {
+							action: 'listen' | 'stop'
+							targets: Array<{
+								script: string
+								asset: { kind: AssetKind; path: string }
+								reads: boolean
+							}>
+						}) => {
+							const byScript = new Map(targets.map((t) => [t.script, t] as const))
+							editScripts(
+								[...byScript.keys()],
+								action === 'listen' ? 'Now reruns on each write' : 'Stopped rerunning on writes',
+								(s) => (c) => {
+									const t = byScript.get(s)!
+									return action === 'listen'
+										? listenToAsset(c, t.asset, t.reads)
+										: stopListeningToAsset(c, t.asset, t.reads)
+								}
+							)
+						}}
+				onAddAssetTrigger={isOperator || mode !== 'edit'
+					? undefined
+					: ({
+							scripts,
+							asset
+						}: {
+							scripts: Array<{ script: string; reads: boolean }>
+							asset: { kind: AssetKind; path: string }
+						}) => {
+							const reads = new Map(scripts.map((s) => [s.script, s.reads] as const))
+							editScripts([...reads.keys()], 'Now reruns on each write', (s) => (c) =>
+								listenToAsset(c, asset, reads.get(s) ?? false)
+							)
+						}}
 				onRunProducer={mode === 'edit' ? handleRunProducer : undefined}
 				onRequestEdit={isOperator ? undefined : () => setMode('edit')}
 				canRunByPath={openScriptHasDataUpload}
@@ -2693,6 +3137,7 @@
 				}}
 				onPersistedSaved={async (savedPath) => {
 					const predicted = predictCascadeFacts([savedPath])
+					forgetScriptCache(savedPath)
 					await graphRes.refetch()
 					reportDeployDrift(predicted)
 				}}
@@ -2700,6 +3145,7 @@
 					if (pe.selection?.kind === 'runnable' && pe.selection.path === oldPath) {
 						pe.selection = { ...pe.selection, path: newPath }
 					}
+					forgetScriptCache(oldPath, newPath)
 					await graphRes.refetch()
 				}}
 				onScriptRemoved={async (removedPath) => {
@@ -2759,6 +3205,102 @@
 <!-- Native trigger drawer wiring: create/edit/delete drawers (edit-mode
      only) + the always-mounted webhook drawer. Driven imperatively from the
      page via `triggerEditors`. -->
+<ConfirmationModal
+	open={multiEdit != undefined}
+	title={`Edit ${multiEdit?.scripts.length ?? 0} scripts?`}
+	confirmationText="Edit scripts"
+	type="info"
+	onConfirmed={() => {
+		const m = multiEdit
+		multiEdit = undefined
+		void m?.run()
+	}}
+	onCanceled={() => (multiEdit = undefined)}
+>
+	{#if multiEdit}
+		<div class="flex flex-col gap-2 text-xs text-secondary">
+			<p>This will edit the annotation header of the following scripts. Each is saved as a draft.</p>
+			<ul class="flex flex-col gap-1">
+				{#each multiEdit.scripts as s (s)}
+					<li class="text-emphasis truncate">{s}</li>
+				{/each}
+			</ul>
+		</div>
+	{/if}
+</ConfirmationModal>
+
+<ConfirmationModal
+	open={assetDeleteTarget != undefined}
+	loading={assetDeleteLoading}
+	title={assetDeleteTarget?.script && assetDeleteTarget.trigger
+		? 'Delete 2 items?'
+		: assetDeleteTarget?.script
+			? `${canHardDeleteScripts ? 'Delete' : 'Archive'} script?`
+			: 'Delete trigger?'}
+	confirmationText={assetDeleteTarget?.script && !canHardDeleteScripts
+		? assetDeleteTarget.trigger
+			? 'Archive and delete'
+			: 'Archive'
+		: 'Delete'}
+	onConfirmed={confirmAssetUpstreamDelete}
+	onCanceled={() => {
+		if (!assetDeleteLoading) assetDeleteTarget = undefined
+	}}
+>
+	{#if assetDeleteTarget}
+		{@const t = assetDeleteTarget}
+		<div class="flex flex-col gap-2 text-xs text-secondary">
+			<p>
+				{#if t.script}
+					{canHardDeleteScripts
+						? 'The script is deleted, with every version'
+						: 'The script is archived'}{t.trigger ? ', and its trigger deleted' : ''}. The tables
+					it wrote stay.
+				{:else}
+					The trigger is deleted: its script stays, and no longer runs this way.
+				{/if}
+			</p>
+			<ul class="flex flex-col gap-1">
+				{#if t.script}
+					<li class="flex flex-col">
+						<span class="text-emphasis truncate">{t.script.path}</span>
+						<span class="text-2xs text-hint">Script{t.script.unsaved ? ' · draft' : ''}</span>
+					</li>
+				{/if}
+				{#if t.trigger}
+					<li class="flex flex-col">
+						<span class="text-emphasis truncate">{t.trigger.path}</span>
+						<span class="text-2xs text-hint"
+							>{t.trigger.kind} trigger{t.trigger.draft ? ' · draft' : ''}</span
+						>
+					</li>
+				{/if}
+			</ul>
+		</div>
+	{/if}
+</ConfirmationModal>
+
+<PipelineDeployTriggersModal
+	open={confirmTriggerDeployOpen}
+	triggerDrafts={pe.triggerDrafts}
+	onConfirmed={() => {
+		confirmTriggerDeployOpen = false
+		if (leaveAfterTriggerConfirm) {
+			leaveAfterTriggerConfirm = false
+			void saveAllAndLeave()
+		} else {
+			void saveAllDrafts()
+		}
+	}}
+	onCanceled={() => {
+		confirmTriggerDeployOpen = false
+		if (leaveAfterTriggerConfirm) {
+			leaveAfterTriggerConfirm = false
+			pendingNavigationUrl = undefined
+		}
+	}}
+/>
+
 <PipelineTriggerEditors
 	bind:this={triggerEditors}
 	mountTriggerEditors={mode === 'edit'}
@@ -2790,18 +3332,18 @@
 						</div>
 						<div class="ml-4 flex-1">
 							<h3 class="text-lg font-medium text-primary">
-								{pe.drafts.size === 1 ? 'Unsaved draft' : `${pe.drafts.size} unsaved drafts`}
+								{pendingCount === 1 ? 'Unsaved draft' : `${pendingCount} unsaved drafts`}
 							</h3>
 							<div class="mt-2 text-sm text-secondary flex flex-col gap-2">
 								<p>
-									You have {pe.drafts.size === 1
-										? 'a draft pipeline script'
-										: `${pe.drafts.size} draft pipeline scripts`} that {pe.drafts.size === 1
+									You have {pendingCount === 1
+										? 'a pipeline draft'
+										: `${pendingCount} pipeline drafts`} that {pendingCount === 1
 										? 'has'
 										: 'have'} not been deployed yet. What would you like to do?
 								</p>
 								<ul class="text-2xs font-mono pl-4 max-h-40 overflow-y-auto flex flex-col gap-0.5">
-									{#each [...pe.drafts.keys()] as p}
+									{#each [...pe.drafts.keys(), ...[...pe.triggerDrafts.values()].map((d) => d.config.path)] as p}
 										<li class="truncate text-tertiary">{p}</li>
 									{/each}
 								</ul>
@@ -2817,7 +3359,7 @@
 							startIcon={{ icon: leaveSaving ? Loader2 : Save }}
 						>
 							<span class="min-w-20"
-								>{leaveSaving ? 'Saving…' : `Save all (${pe.drafts.size})`}</span
+								>{leaveSaving ? 'Saving…' : `Save all (${pendingCount})`}</span
 							>
 						</Button>
 						<Button
diff --git a/frontend/src/routes/(root)/(logged)/remote_deploy/callback/+page.svelte b/frontend/src/routes/(root)/(logged)/remote_deploy/callback/+page.svelte
index c702f66471..58739ee36a 100644
--- a/frontend/src/routes/(root)/(logged)/remote_deploy/callback/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/remote_deploy/callback/+page.svelte
@@ -58,7 +58,7 @@
 	})
 </script>
 
-<CenteredModal title="Connecting to the remote instance">
+<CenteredModal title="Connecting to the remote instance" inPage>
 	{#if status === 'connecting'}
 		<div class="flex justify-center py-6"><Loader2 class="animate-spin" /></div>
 	{:else if status === 'connected'}
diff --git a/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte b/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
index 183d10a003..8fb926d405 100644
--- a/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
@@ -70,7 +70,9 @@
 	import HighlightCode from '$lib/components/HighlightCode.svelte'
 	import JobLoader from '$lib/components/JobLoader.svelte'
 	import LogViewer from '$lib/components/LogViewer.svelte'
-	import { ActionRow, Button, Skeleton, Tab, Alert, DrawerContent } from '$lib/components/common'
+	import { Button, Skeleton, Tab, Alert, DrawerContent } from '$lib/components/common'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
 	import JobDetailHeader from '$lib/components/runs/JobDetailHeader.svelte'
 	import ScriptRetryChain from '$lib/components/runs/ScriptRetryChain.svelte'
 	import FlowExecutionStatus from '$lib/components/runs/FlowExecutionStatus.svelte'
@@ -122,6 +124,7 @@
 		onEditInForkClick
 	} from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
+	import { AGENT_STEP_ID } from '$lib/components/flows/conversations/agentEditorChat'
 	let job: (Job & { result?: any; result_stream?: string }) | undefined = $state()
 	let jobUpdateLastFetch: Date | undefined = $state()
 
@@ -648,6 +651,10 @@
 		}
 	})
 	onDestroy(resetFavicon)
+
+	// The bar shares its row with the breadcrumb, and this page's name is a uuid that gives way
+	// grudgingly, so the buttons drop their labels rather than push each other off the end.
+	const compactBar = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < 1150)
 </script>
 
 <HighlightTheme />
@@ -805,289 +812,305 @@
 		class="max-w-7xl p-4 mx-auto w-full"
 		loading={!job}
 		layout={[
-			// 1. Top Action Bar (buttons on right side)
-			[
-				{ h: 2.5, w: 60 },
-				{ h: 2.5, w: 40 }
-			],
-			1,
-			// 2. Job Header
+			// 1. Job Header
 			[{ h: 12, w: 100 }],
 			1,
-			// 3. Progress Bar
+			// 2. Progress Bar
 			[{ h: 2, w: 100 }],
 			1.5
 		]}
 	/>
-	<ActionRow class="max-w-7xl px-4 mx-auto w-full">
-		{#snippet left()}
-			<h1 class="text-sm font-semibold text-primary">run/{page.params.run}</h1>
-		{/snippet}
-		{#snippet right()}
-			{@const isScript = job?.job_kind === 'script'}
-			{@const isHubFlowPreview = isFlowPreview(job?.job_kind) && isHubFlowPath(job?.script_path)}
-			{@const runsHref = `/runs/${job?.script_path}${!isScript ? '?jobKind=flow' : ''}`}
-			{#if job && 'deleted' in job && !job?.deleted && ($superadmin || ($userStore?.is_admin ?? false))}
-				<Dropdown
-					items={[
-						{
-							displayName: 'Delete result, logs and args (admin only)',
-							action: () => {
-								job?.id && deleteCompletedJob(job.id)
-							},
-							type: 'delete'
-						}
-					]}
-				>
-					{#snippet buttonReplacement()}
-						<Button
-							nonCaptureEvent
-							variant="default"
-							unifiedSize="sm"
-							startIcon={{ icon: Trash }}
-						/>
-					{/snippet}
-				</Dropdown>
-				{#if job?.job_kind === 'script' || job?.job_kind === 'flow'}
-					<Button href={runsHref} variant="default" unifiedSize="sm" startIcon={{ icon: List }}>
-						View runs
-					</Button>
-				{/if}
-			{/if}
-			{#if job}
-				<Dropdown
-					customWidth={280}
-					items={[
-						{
-							displayName: 'Copy link for members',
-							icon: Users,
-							tooltip:
-								'Read-only link to this run for another member of this workspace. They must be logged in.',
-							action: () => job && shareReadLink(job.id)
+	<!-- `section`, not an item: a run is not a workspace item the picker can open, so the trail
+	     ends with its id as a plain name. -->
+	<PageHeaderContent section={{ label: `run/${page.params.run}` }} actions={runActions} />
+
+	{#snippet runActions()}
+		{@const isScript = job?.job_kind === 'script'}
+		{@const isHubFlowPreview = isFlowPreview(job?.job_kind) && isHubFlowPath(job?.script_path)}
+		{@const runsHref = `/runs/${job?.script_path}${!isScript ? '?jobKind=flow' : ''}`}
+		{#if job && 'deleted' in job && !job?.deleted && ($superadmin || ($userStore?.is_admin ?? false))}
+			<Dropdown
+				items={[
+					{
+						displayName: 'Delete result, logs and args (admin only)',
+						action: () => {
+							job?.id && deleteCompletedJob(job.id)
 						},
+						type: 'delete'
+					}
+				]}
+			>
+				{#snippet buttonReplacement()}
+					<Button nonCaptureEvent variant="default" unifiedSize="sm" startIcon={{ icon: Trash }} />
+				{/snippet}
+			</Dropdown>
+			{#if job?.job_kind === 'script' || job?.job_kind === 'flow'}
+				<Button
+					href={runsHref}
+					variant="default"
+					unifiedSize="sm"
+					iconOnly={compactBar}
+					title="View runs"
+					startIcon={{ icon: List }}
+				>
+					View runs
+				</Button>
+			{/if}
+		{/if}
+		{#if job}
+			<Dropdown
+				customWidth={280}
+				items={[
+					{
+						displayName: 'Copy link for members',
+						icon: Users,
+						tooltip:
+							'Read-only link to this run for another member of this workspace. They must be logged in.',
+						action: () => job && shareReadLink(job.id)
+					},
+					{
+						displayName: 'Copy public link',
+						icon: Globe,
+						disabled: !canSharePublicly,
+						tooltip: canSharePublicly
+							? "Read-only link that anyone on the internet can open, without logging in. It shows a minimal version of this page: this run's inputs, result and logs, and for a flow its graph plus every step's inputs, result, logs and code. The link cannot be revoked."
+							: 'Sharing a run publicly is restricted in this workspace. Ask an admin to share it, or to grant you a bypass on the ruleset.',
+						action: () => job && sharePublicLink(job.id)
+					}
+				]}
+			>
+				{#snippet buttonReplacement()}
+					<Button
+						nonCaptureEvent
+						variant="default"
+						unifiedSize="sm"
+						iconOnly={compactBar}
+						title="Share"
+						startIcon={{ icon: Share2 }}
+					>
+						Share
+					</Button>
+				{/snippet}
+			</Dropdown>
+		{/if}
+		{@const stem = job?.job_kind === 'script_hub' ? '/scripts' : `/${job?.job_kind}s`}
+		{@const viewHref = `${stem}/get/${isScript ? job?.script_hash : job?.script_path}`}
+		{#if (job?.job_kind == 'flow' || isFlowPreview(job?.job_kind)) && job?.['running'] && job?.parent_job == undefined}
+			<div class="inline">
+				<Dropdown
+					items={[
 						{
-							displayName: 'Copy public link',
-							icon: Globe,
-							disabled: !canSharePublicly,
-							tooltip: canSharePublicly
-								? "Read-only link that anyone on the internet can open, without logging in. It shows a minimal version of this page: this run's inputs, result and logs, and for a flow its graph plus every step's inputs, result, logs and code. The link cannot be revoked."
-								: 'Sharing a run publicly is restricted in this workspace. Ask an admin to share it, or to grant you a bypass on the ruleset.',
-							action: () => job && sharePublicLink(job.id)
+							displayName: 'Show Flow Debug Info',
+							action: () => {
+								debugInfo()
+							}
 						}
 					]}
+					class="h-auto"
 				>
 					{#snippet buttonReplacement()}
-						<Button nonCaptureEvent variant="default" unifiedSize="sm" startIcon={{ icon: Share2 }}>
-							Share
+						<Button nonCaptureEvent unifiedSize="sm" variant="subtle">
+							<div class="flex flex-row items-center">
+								<EllipsisVertical size={14} />
+							</div>
 						</Button>
 					{/snippet}
 				</Dropdown>
-			{/if}
-			{@const stem = job?.job_kind === 'script_hub' ? '/scripts' : `/${job?.job_kind}s`}
-			{@const viewHref = `${stem}/get/${isScript ? job?.script_hash : job?.script_path}`}
-			{#if (job?.job_kind == 'flow' || isFlowPreview(job?.job_kind)) && job?.['running'] && job?.parent_job == undefined}
-				<div class="inline">
-					<Dropdown
-						items={[
-							{
-								displayName: 'Show Flow Debug Info',
-								action: () => {
-									debugInfo()
-								}
-							}
-						]}
-						class="h-auto"
-					>
-						{#snippet buttonReplacement()}
-							<Button nonCaptureEvent unifiedSize="sm" variant="subtle">
-								<div class="flex flex-row items-center">
-									<EllipsisVertical size={14} />
-								</div>
-							</Button>
-						{/snippet}
-					</Dropdown>
-				</div>
-			{/if}
-			{#if isFlowPreview(job?.job_kind) || isScriptPreview(job?.job_kind)}
+			</div>
+		{/if}
+		{#if isFlowPreview(job?.job_kind) || isScriptPreview(job?.job_kind)}
+			<Button
+				unifiedSize="sm"
+				variant="default"
+				iconOnly={compactBar}
+				title={isHubFlowPreview
+					? 'Fork flow into workspace'
+					: `Fork ${isFlowPreview(job?.job_kind) ? 'flow' : 'code'} preview`}
+				startIcon={{ icon: GitBranch }}
+				on:click={forkPreview}
+			>
+				{isHubFlowPreview
+					? 'Fork flow into workspace'
+					: `Fork ${isFlowPreview(job?.job_kind) ? 'flow' : 'code'} preview`}
+			</Button>
+		{/if}
+		{#if persistentScriptDefinition !== undefined}
+			<Button
+				unifiedSize="sm"
+				variant="default"
+				iconOnly={compactBar}
+				title="Current runs"
+				startIcon={{ icon: Activity }}
+				on:click={() => {
+					persistentScriptDrawer?.open?.(persistentScriptDefinition)
+				}}
+			>
+				Current runs
+			</Button>
+		{/if}
+		{#if canRunNow}
+			<Button
+				unifiedSize="md"
+				variant="default"
+				startIcon={{ icon: Play }}
+				on:click={() => job?.id && runJobNow(job.id)}
+				title="Start this job now instead of at its scheduled time, skipping any remaining delay or sleep. It keeps the same id, and a concurrency limit is still enforced."
+			>
+				Run now
+			</Button>
+		{/if}
+		{#if job && job?.type != 'CompletedJob' && (!job?.schedule_path || job?.['running'] == true)}
+			{#if !forceCancel}
 				<Button
-					unifiedSize="sm"
-					variant="default"
-					startIcon={{ icon: GitBranch }}
-					on:click={forkPreview}
-				>
-					{isHubFlowPreview
-						? 'Fork flow into workspace'
-						: `Fork ${isFlowPreview(job?.job_kind) ? 'flow' : 'code'} preview`}
-				</Button>
-			{/if}
-			{#if persistentScriptDefinition !== undefined}
-				<Button
-					unifiedSize="sm"
-					variant="default"
-					startIcon={{ icon: Activity }}
-					on:click={() => {
-						persistentScriptDrawer?.open?.(persistentScriptDefinition)
-					}}
-				>
-					Current runs
-				</Button>
-			{/if}
-			{#if canRunNow}
-				<Button
-					unifiedSize="md"
-					variant="default"
-					startIcon={{ icon: Play }}
-					on:click={() => job?.id && runJobNow(job.id)}
-					title="Start this job now instead of at its scheduled time, skipping any remaining delay or sleep. It keeps the same id, and a concurrency limit is still enforced."
-				>
-					Run now
-				</Button>
-			{/if}
-			{#if job && job?.type != 'CompletedJob' && (!job?.schedule_path || job?.['running'] == true)}
-				{#if !forceCancel}
-					<Button
-						unifiedSize="sm"
-						variant="accent"
-						destructive
-						startIcon={{ icon: TimerOff }}
-						on:click|once={() => {
-							if (job?.id) {
-								cancelJob(job?.id)
-								setTimeout(() => {
-									forceCancel = true
-								}, 3001)
-							}
-						}}
-						title={`Cancel the ${job?.job_kind === 'script' ? 'script' : job?.job_kind === 'flow' ? 'flow' : 'job'}`}
-					>
-						Cancel
-					</Button>
-				{:else}
-					<Button
-						unifiedSize="sm"
-						variant="accent"
-						destructive
-						startIcon={{ icon: TimerOff }}
-						on:click|once={() => {
-							if (job?.id) {
-								cancelJob(job?.id)
-							}
-						}}
-					>
-						Force Cancel
-					</Button>
-				{/if}
-			{/if}
-			{#if job?.schedule_path}
-				<Button
-					unifiedSize="sm"
-					variant="default"
-					on:click={() => {
-						if (!job || !job.schedule_path) {
-							return
-						}
-						scheduleEditor?.openEdit(job.schedule_path, job.job_kind == 'flow')
-					}}
-					startIcon={{ icon: Calendar }}>Edit schedule</Button
-				>
-			{/if}
-			{#if restartStep !== undefined && canRestart(restart)}
-				{@render flowRestartButton(restart, restartStep, 'button')}
-			{/if}
-			{#if job?.job_kind === 'script' || job?.job_kind === 'script_hub' || job?.job_kind === 'flow'}
-				<Button
-					on:click|once={async () => {
-						// The form this lands on rebuilds the whole project. When resuming
-						// THIS run is the cheaper thing to do, name it so the form can
-						// offer that in one click rather than leaving the reader to know.
-						const from = dbtResumable ? `?dbt_retry_from=${job?.id}` : ''
-						goto(
-							viewHref +
-								from +
-								`#${computeSharableHash(job?.args, await getRerunTagOverride(job?.args))}`
-						)
-					}}
-					unifiedSize="sm"
-					variant="default"
-					startIcon={{ icon: RefreshCw }}
-					loading={runImmediatelyLoading}
-					dropdownItems={[
-						// A failed dbt run's cheap next step is resuming its failed and skipped
-						// nodes rather than rebuilding the project, and `dbt_command` is the
-						// only argument that differs. Offered first, and only while the saved
-						// failure is still this run — which is what `dbtResumable` answers.
-						...(dbtResumable ? [{ label: 'dbt retry with same args', onClick: resumeDbtRun }] : []),
-						{
-							label: 'Run immediately with same args',
-							onClick: () => runImmediately()
-						}
-					]}
-				>
-					Run again
-				</Button>
-			{/if}
-			{#if job?.job_kind === 'script' || job?.job_kind === 'flow'}
-				{#if !$userStore?.operator}
-					{#if canWrite(job?.script_path ?? '', {}, $userStore)}
-						<Button
-							href={`${stem}/edit/${job?.script_path}?workspace=${$workspaceStore}`}
-							on:click={() => {
-								$initialArgsStore = job?.args
-							}}
-							unifiedSize="sm"
-							variant="default"
-							disabled={!showEditButton}
-							startIcon={{ icon: Pen }}>Edit</Button
-						>
-						{#if showEditButton}
-							<!-- Opens the deployed runnable at this job's path, like Edit — unlike
-							     "View script", which pins the hash this run executed. Same gate as
-							     Edit: where direct deployment is off, the way in is "Edit in fork". -->
-							<OpenInSessionButton
-								source={{
-									target: { kind: isScript ? 'script' : 'flow', path: job?.script_path ?? '' },
-									workspaceId: $workspaceStore ?? undefined
-								}}
-								btnProps={{ unifiedSize: 'sm' }}
-							/>
-						{/if}
-					{/if}
-					{#if !showEditButton && !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces)}
-						<Button
-							href={buildForkEditUrl(isScript ? 'script' : 'flow', job?.script_path ?? '')}
-							onClick={(e) =>
-								onEditInForkClick(e, isScript ? 'script' : 'flow', job?.script_path ?? '', {
-									hasHref: true
-								})}
-							unifiedSize="sm"
-							variant="default"
-							startIcon={{ icon: Pen }}>{editInForkLabel($workspaceStore, $userWorkspaces)}</Button
-						>
-					{/if}
-				{/if}
-			{/if}
-			{#if job?.job_kind === 'script' || job?.job_kind === 'script_hub' || job?.job_kind === 'flow'}
-				<Button
-					href={viewHref}
 					unifiedSize="sm"
 					variant="accent"
-					startIcon={{
-						icon:
-							job?.job_kind === 'script' || job?.job_kind === 'script_hub'
-								? Code2
-								: job?.job_kind === 'flow'
-									? BarsStaggered
-									: Code2
+					destructive
+					startIcon={{ icon: TimerOff }}
+					on:click|once={() => {
+						if (job?.id) {
+							cancelJob(job?.id)
+							setTimeout(() => {
+								forceCancel = true
+							}, 3001)
+						}
+					}}
+					title={`Cancel the ${job?.job_kind === 'script' ? 'script' : job?.job_kind === 'flow' ? 'flow' : 'job'}`}
+				>
+					Cancel
+				</Button>
+			{:else}
+				<Button
+					unifiedSize="sm"
+					variant="accent"
+					destructive
+					startIcon={{ icon: TimerOff }}
+					on:click|once={() => {
+						if (job?.id) {
+							cancelJob(job?.id)
+						}
 					}}
 				>
-					View {job?.job_kind === 'script_hub' ? 'script' : job?.job_kind}
+					Force Cancel
 				</Button>
 			{/if}
-		{/snippet}
-	</ActionRow>
+		{/if}
+		{#if job?.schedule_path}
+			<Button
+				unifiedSize="sm"
+				variant="default"
+				on:click={() => {
+					if (!job || !job.schedule_path) {
+						return
+					}
+					scheduleEditor?.openEdit(job.schedule_path, job.job_kind == 'flow')
+				}}
+				startIcon={{ icon: Calendar }}>Edit schedule</Button
+			>
+		{/if}
+		{#if restartStep !== undefined && canRestart(restart)}
+			{@render flowRestartButton(restart, restartStep, 'button')}
+		{/if}
+		{#if job?.job_kind === 'script' || job?.job_kind === 'script_hub' || job?.job_kind === 'flow'}
+			<Button
+				on:click|once={async () => {
+					// The form this lands on rebuilds the whole project. When resuming
+					// THIS run is the cheaper thing to do, name it so the form can
+					// offer that in one click rather than leaving the reader to know.
+					const from = dbtResumable ? `?dbt_retry_from=${job?.id}` : ''
+					goto(
+						viewHref +
+							from +
+							`#${computeSharableHash(job?.args, await getRerunTagOverride(job?.args))}`
+					)
+				}}
+				unifiedSize="sm"
+				variant="default"
+				iconOnly={compactBar}
+				title="Run again"
+				startIcon={{ icon: RefreshCw }}
+				loading={runImmediatelyLoading}
+				dropdownItems={[
+					// A failed dbt run's cheap next step is resuming its failed and skipped
+					// nodes rather than rebuilding the project, and `dbt_command` is the
+					// only argument that differs. Offered first, and only while the saved
+					// failure is still this run — which is what `dbtResumable` answers.
+					...(dbtResumable ? [{ label: 'dbt retry with same args', onClick: resumeDbtRun }] : []),
+					{
+						label: 'Run immediately with same args',
+						onClick: () => runImmediately()
+					}
+				]}
+			>
+				Run again
+			</Button>
+		{/if}
+		{#if job?.job_kind === 'script' || job?.job_kind === 'flow'}
+			{#if !$userStore?.operator}
+				{#if canWrite(job?.script_path ?? '', {}, $userStore)}
+					<Button
+						href={`${stem}/edit/${job?.script_path}?workspace=${$workspaceStore}`}
+						on:click={() => {
+							$initialArgsStore = job?.args
+						}}
+						unifiedSize="sm"
+						variant="default"
+						disabled={!showEditButton}
+						iconOnly={compactBar}
+						title="Edit"
+						startIcon={{ icon: Pen }}>Edit</Button
+					>
+					{#if showEditButton}
+						<!-- Opens the deployed runnable at this job's path, like Edit — unlike
+							     "View script", which pins the hash this run executed. Same gate as
+							     Edit: where direct deployment is off, the way in is "Edit in fork". -->
+						<OpenInSessionButton
+							source={{
+								target: { kind: isScript ? 'script' : 'flow', path: job?.script_path ?? '' },
+								workspaceId: $workspaceStore ?? undefined
+							}}
+							btnProps={{ unifiedSize: 'sm' }}
+						/>
+					{/if}
+				{/if}
+				{#if !showEditButton && !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces)}
+					<Button
+						href={buildForkEditUrl(isScript ? 'script' : 'flow', job?.script_path ?? '')}
+						onClick={(e) =>
+							onEditInForkClick(e, isScript ? 'script' : 'flow', job?.script_path ?? '', {
+								hasHref: true
+							})}
+						unifiedSize="sm"
+						variant="default"
+						iconOnly={compactBar}
+						title={editInForkLabel($workspaceStore, $userWorkspaces)}
+						startIcon={{ icon: Pen }}>{editInForkLabel($workspaceStore, $userWorkspaces)}</Button
+					>
+				{/if}
+			{/if}
+		{/if}
+		{#if job?.job_kind === 'script' || job?.job_kind === 'script_hub' || job?.job_kind === 'flow'}
+			<Button
+				href={viewHref}
+				unifiedSize="sm"
+				variant="accent"
+				iconOnly={compactBar}
+				title="View {job?.job_kind === 'script_hub' ? 'script' : job?.job_kind}"
+				startIcon={{
+					icon:
+						job?.job_kind === 'script' || job?.job_kind === 'script_hub'
+							? Code2
+							: job?.job_kind === 'flow'
+								? BarsStaggered
+								: Code2
+				}}
+			>
+				View {job?.job_kind === 'script_hub' ? 'script' : job?.job_kind}
+			</Button>
+		{/if}
+	{/snippet}
 	<div class={twMerge('w-full', isNotFlow(job?.job_kind) && 'pb-8')}>
 		<!-- Flow Detail Header Card -->
-		<div class="max-w-7xl mx-auto px-4 py-0">
+		<div class="max-w-7xl mx-auto px-4 pt-4">
 			<Skeleton loading={!job} layout={[[24]]} />
 			{#if job}
 				<JobDetailHeader
@@ -1122,7 +1145,8 @@
 					showStepId
 				>
 					{#snippet errorAction()}
-						{#if failedTopLevelStep}
+						<!-- A saved agent's run is its one step: naming it adds nothing. -->
+						{#if failedTopLevelStep && failedTopLevelStep !== AGENT_STEP_ID}
 							<span>at step {failedTopLevelStep}</span>
 							{#if $enterpriseLicense && canRestart(failedRestart)}
 								<span>·</span>
diff --git a/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
index 49ad076d23..6110af0fef 100644
--- a/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
@@ -541,6 +541,7 @@
 {#if draftSync.draft && renderEditor}
 	<ScriptBuilder
 		bind:this={scriptBuilder}
+		ownsPageHeader
 		{initialPath}
 		userDraftPath={draftPath}
 		{draftBaseHash}
diff --git a/frontend/src/routes/(root)/(logged)/service_logs/+page.svelte b/frontend/src/routes/(root)/(logged)/service_logs/+page.svelte
index 5b8e56b5a2..124390aabe 100644
--- a/frontend/src/routes/(root)/(logged)/service_logs/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/service_logs/+page.svelte
@@ -2,7 +2,6 @@
 	import { page } from '$app/state'
 	import { Alert } from '$lib/components/common'
 	import ServiceLogsInner from '$lib/components/ServiceLogsInner.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { devopsRole } from '$lib/stores'
 
 	// `query` is what the global search links with; `searchTerm` is what the page writes back.
@@ -11,24 +10,16 @@
 	)
 </script>
 
-{#snippet title()}
-	<div class="flex items-center gap-2">
-		<h1 class="text-2xl font-semibold text-emphasis whitespace-nowrap">Service logs</h1>
-		<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/service_logs">
-			Logs written by the servers, workers and indexers of this instance, grouped by host.
-		</Tooltip>
-	</div>
-{/snippet}
-
-<div class="flex flex-col w-full min-w-0 h-screen max-h-screen px-4">
+<!-- `h-full`, not `h-screen`: the page header band sits above this box, so a viewport floor here
+     would overhang the content box by the band's height. -->
+<div class="flex flex-col w-full min-w-0 h-full max-h-full px-4">
 	{#if $devopsRole == false}
 		<div class="flex flex-col gap-2 pt-4">
-			{@render title()}
 			<Alert title="Service logs are only available to superadmins and devops users" type="warning">
 				Ask one of them to look at the logs, or to grant you the devops role.
 			</Alert>
 		</div>
 	{:else}
-		<ServiceLogsInner bind:searchTerm {title} />
+		<ServiceLogsInner bind:searchTerm />
 	{/if}
 </div>
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index 1662c15d79..97ed4b95b6 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -1,21 +1,25 @@
 <script lang="ts">
-	import { onMount, tick, untrack } from 'svelte'
+	import { onDestroy, onMount, tick, untrack } from 'svelte'
 	import { SvelteSet } from 'svelte/reactivity'
 	import { page } from '$app/state'
 	import {
 		Plus,
 		Maximize2,
-		Minimize2,
 		ExternalLink,
 		PanelRightClose,
 		PanelRightOpen,
+		Minimize2,
 		ChevronDown,
 		MonitorPlay,
 		Loader2
 	} from 'lucide-svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { BAR_TOP_PAD } from '$lib/components/pageHeaderRegistry.svelte'
 	import { Button } from '$lib/components/common'
 	import DraggableTabs, { type TabItem } from '$lib/components/common/tabs/DraggableTabs.svelte'
+	import { cubicOut } from 'svelte/easing'
+	import { useReducedMotion } from '$lib/svelte5Utils.svelte'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import PreviewRouterPicker, {
 		type Scope
@@ -448,6 +452,55 @@
 	let emptyStateNewTabOpen = $state(false)
 
 	let fullscreen = $state(false)
+
+	// Going full screen is the preview panel expanding to the left: the chat column shrinks to
+	// nothing and the panel takes its place. Animating that is what carries the switch, so the
+	// panel is never unmounted — it is resized, like a collapse — and the tab strips, which live
+	// in two different trees (the panel's own card, and the band), only fade.
+	const reducedMotion = useReducedMotion()
+	const PANES_MOVE_MS = 240
+	/** Panes transition their width only while a full-screen switch is in flight. Left on, every
+	 *  splitter drag would lag 240ms behind the pointer. */
+	let panesAnimating = $state(false)
+	let panesAnimationTimer: ReturnType<typeof setTimeout> | undefined = undefined
+	function toggleFullscreen() {
+		fullscreen = !fullscreen
+		if (reducedMotion.val) return
+		panesAnimating = true
+		clearTimeout(panesAnimationTimer)
+		panesAnimationTimer = setTimeout(() => (panesAnimating = false), PANES_MOVE_MS)
+	}
+	onDestroy(() => clearTimeout(panesAnimationTimer))
+	/** The arriving strip fades in over the expansion; the leaving one goes quickly, so the two
+	 *  are never both legible at once — they stand in different places, and a slow dissolve would
+	 *  read as two tab rows rather than one changing place. */
+	function stripArrive(_node: Element) {
+		return reducedMotion.val
+			? { duration: 0 }
+			: { duration: 180, delay: 60, easing: cubicOut, css: (t: number) => `opacity: ${t}` }
+	}
+	function stripLeave(_node: Element) {
+		return reducedMotion.val
+			? { duration: 0 }
+			: { duration: 80, easing: cubicOut, css: (t: number) => `opacity: ${t}` }
+	}
+	// Width of the preview panel, so the band can stop where it starts.
+	let previewWidth = $state(0)
+	/** Width of the row the panes share, so the panel can be remembered as a share of it. */
+	let contentWidth = $state(0)
+	/** What share of that row the panel takes, sampled only while it is standing still. The band's
+	 *  inset is read from this for the length of a full-screen switch: fed the live measurement,
+	 *  the bar would be sized against a panel that has not arrived yet, and on the way back from
+	 *  full screen it starts at 146px — narrow enough that the bar wraps to two rows before the
+	 *  panel settles. A share rather than a width, so a window resized while full screen still
+	 *  gives the right inset on the way out. */
+	let panelShare = $state(0)
+	const bandInset = $derived.by(() => {
+		if (fullscreen) return 0
+		if (panesAnimating && panelShare > 0 && contentWidth > 0)
+			return Math.round(panelShare * contentWidth)
+		return previewCollapsed || previewWidth === 0 ? undefined : previewWidth
+	})
 	// Fullscreen is page state, not per-session, so it outlives a session switch —
 	// tell the incoming session's model, whose own collapsed flag it overrides, or
 	// re-opening the item plainly on screen would be judged invisible and not flash.
@@ -501,9 +554,10 @@
 				lastExpandedPreviewSize = previewPaneSize
 			}
 			if (full) {
-				// Chat pane is unmounted: the preview is the only pane and must own
-				// the full width, not its remembered split share.
+				// The preview owns the full width, not its remembered split share. The chat pane
+				// stays mounted at zero, so it has to be driven to 0 in the same pass.
 				previewPaneSize = 100
+				chatPaneSize = 0
 			} else if (collapsed) {
 				previewPaneSize = 0
 				chatPaneSize = 100
@@ -904,6 +958,52 @@
 	}}
 />
 
+<!-- The session showing fills the band's breadcrumb. The band is the layout's, but it stops
+     where the preview panel starts so that panel can run from the top of the viewport. -->
+<!-- In full screen the band carries the session's name and, as one filling surface, the preview's
+     own strip and controls. The name here is only what shows until the active session's
+     SessionWrapper has mounted: it registers after this does, and the registry merges later-wins,
+     so from then on the name comes from there, with its pen and its menu. -->
+<PageHeaderContent
+	barRightInset={bandInset}
+	section={fullscreen ? { label: activeSession?.summary ?? 'Untitled session' } : undefined}
+	actions={fullscreen ? fullscreenBand : sessionPageActions}
+	actionsFill={fullscreen}
+	separator={fullscreen ? 'always' : 'none'}
+/>
+
+{#snippet fullscreenBand()}
+	<!-- The band is split in two: the breadcrumb on the page's own surface, and from there to the
+	     right edge one filled panel carrying the tabs and the preview's controls. It takes the bar's
+	     full height, and the bar's bottom border runs underneath it, so the line between header and
+	     content is unbroken. -->
+	<div
+		class="flex-1 min-w-0 self-stretch flex items-center gap-1 pl-2.5 pr-2 bg-surface-secondary/50"
+	>
+		{@render previewTabStrip(true)}
+		<div class="flex-1 min-w-4"></div>
+		<div class="flex items-center gap-0.5 shrink-0">
+			{@render previewControls()}
+		</div>
+	</div>
+{/snippet}
+
+{#snippet sessionPageActions()}
+	{#if previewCollapsed && !fullscreen}
+		<!-- Collapsed preview: the way back to the side panel, in the band with the session's own
+		     controls rather than floating over the chat. -->
+		<Button
+			variant="subtle"
+			unifiedSize="sm"
+			startIcon={{ icon: PanelRightOpen }}
+			title="Open side panel"
+			onclick={() => owner?.setCollapsed(false)}
+		>
+			Open side panel
+		</Button>
+	{/if}
+{/snippet}
+
 <div class="h-full flex flex-col min-h-0">
 	{#if embedded}
 		<!-- Rendered inside a preview iframe — opening the sessions UI here would
@@ -928,7 +1028,7 @@
 			<p class="text-primary font-medium">AI Sessions are not available for operators</p>
 			<p>Use the Ask AI chat instead.</p>
 			<Button
-				size="xs"
+				unifiedSize="xs"
 				onclick={() => {
 					try {
 						localStorage.setItem('ai-chat-open', 'true')
@@ -970,33 +1070,58 @@
 		     switch, and a verdict still loading would otherwise tear them down on every
 		     one. The covered stack is inert so nothing under the overlay takes focus. -->
 		<div class="flex-1 min-h-0 flex flex-col relative">
+			<!-- Leaving full screen, the panel travels back to the right across ground the band has
+			     already claimed: the band is pinned to the width the panel will end at, so under it
+			     the bar would show through as a white patch over the panel's left edge and the left
+			     end of its tab strip. z-[31] — one above the band — puts the panel over it for the
+			     length of the move instead, uncovering it as it settles. Entering full screen needs
+			     none of this: the band is full width from the first frame and the panel stays below. -->
 			<div
-				class="flex-1 min-h-0 flex flex-row relative z-0"
+				bind:clientWidth={contentWidth}
+				class="flex-1 min-h-0 flex flex-row relative {panesAnimating && !fullscreen
+					? 'z-[31]'
+					: 'z-0'}"
 				use:splitterPointerCapture
 				inert={aiHiddenVerdict !== false}
 			>
 				<Splitpanes
 					horizontal={false}
-					class="flex-1 min-h-0 session-splitter {previewCollapsed ? 'splitter-off' : ''}"
+					style="--panes-move: {PANES_MOVE_MS}ms"
+					class="flex-1 min-h-0 session-splitter {previewCollapsed || fullscreen
+						? 'splitter-off'
+						: ''} {panesAnimating ? 'panes-animating' : ''}"
 				>
-					{#if !fullscreen}
-						<!-- Chat column. Recently visited sessions stay mounted (stacked,
+					<!-- Chat column. Recently visited sessions stay mounted (stacked,
 					     visibility-toggled) — see mountChat. -->
-						<Pane bind:size={chatPaneSize} minSize={25} class="flex flex-col min-h-0">
-							<div class="relative flex-1 min-h-0">
-								{#each mountedChatSessions as s (s.id)}
-									<div
-										class="absolute inset-0 flex flex-col {s.id === activeSession?.id
-											? 'z-10 opacity-100 pointer-events-auto'
-											: 'z-0 opacity-0 pointer-events-none'}"
-										aria-hidden={s.id !== activeSession?.id}
-									>
-										<SessionWrapper sessionId={s.id} />
-									</div>
-								{/each}
-							</div>
-						</Pane>
-					{/if}
+					<!-- The band floats over this column's top strip while a panel is beside it, so the
+					     column starts below it. The offset belongs on the pane, not on the stack's
+					     container: the session stacks are `absolute inset-0` and would ignore padding. -->
+					<!-- Full screen resizes this column to nothing rather than unmounting it, so the
+					     panel can be seen taking its place — and so a toggle doesn't tear down every
+					     mounted chat and rebuild it on the way back. -->
+					<Pane
+						bind:size={chatPaneSize}
+						minSize={fullscreen ? 0 : 25}
+						class="flex flex-col min-h-0 {previewCollapsed ? '' : BAR_TOP_PAD} {panesAnimating &&
+						!fullscreen
+							? '!bg-transparent'
+							: ''}"
+					>
+						<!-- Zero-width but still in the document, so its composer and buttons are taken
+						     out of the tab order while the panel is full screen. -->
+						<div class="relative flex-1 min-h-0" inert={fullscreen}>
+							{#each mountedChatSessions as s (s.id)}
+								<div
+									class="absolute inset-0 flex flex-col {s.id === activeSession?.id
+										? 'z-10 opacity-100 pointer-events-auto'
+										: 'z-0 opacity-0 pointer-events-none'}"
+									aria-hidden={s.id !== activeSession?.id}
+								>
+									<SessionWrapper sessionId={s.id} headerInPage={s.id === activeSession?.id} />
+								</div>
+							{/each}
+						</div>
+					</Pane>
 
 					<!-- Preview panel: the live Windmill page, framed like the editor pane.
 				     Always mounted (collapse resizes it to 0 — see previewPaneSize) so
@@ -1007,7 +1132,19 @@
 						maxSize={previewCollapsed ? 0 : 100}
 						class="flex flex-col min-h-0"
 					>
-						<div class="flex-1 min-h-0 flex flex-col {fullscreen ? 'p-0' : 'p-2 pl-0'}">
+						<!-- The band floats over this column too in full screen (it holds the tab strip
+						     there), so the panel clears it with the same offset the chat column uses. -->
+						<div
+							bind:clientWidth={
+								() => previewWidth,
+								(w) => {
+									previewWidth = w
+									if (!fullscreen && !panesAnimating && contentWidth > 0)
+										panelShare = w / contentWidth
+								}
+							}
+							class="flex-1 min-h-0 flex flex-col {fullscreen ? `p-0 ${BAR_TOP_PAD}` : 'p-2 pl-0'}"
+						>
 							<!-- The action controls float over the tab strip, so the strip has to reserve
 							     their width or tabs slide underneath them. Measured rather than guessed:
 							     the set changes with the tab (an artifact has no "Open in workspace", a
@@ -1033,141 +1170,22 @@
 									</button>
 								{/if}
 
-								<!-- Open-in-full-page + full-screen toggle, floating over the top-right
-								     corner to mirror the collapse control. -->
-								<!-- Spans the tab strip's own height and centres within it, rather than
-							     being pinned a fixed distance from the top, so these controls sit on
-							     the same axis as the collapse button opposite. Its width is measured
-							     so the strip can reserve room and its tabs never scroll underneath. -->
-								<div
-									bind:clientWidth={previewActionsWidth}
-									class="absolute top-0 right-1 z-30 flex h-8 items-center gap-0.5"
-								>
-									{#if activeWorkspaceHref}
-										<a
-											href={withWorkspaceParam(activeWorkspaceHref, previewWorkspace)}
-											title="Open in workspace"
-											aria-label="Open in workspace"
-											class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
-										>
-											<ExternalLink size={14} />
-										</a>
-									{/if}
-									<button
-										type="button"
-										onclick={() => (fullscreen = !fullscreen)}
-										title={fullscreen ? 'Exit full screen' : 'Full screen'}
-										aria-label={fullscreen ? 'Exit full screen' : 'Full screen'}
-										class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
+								<!-- In full screen the strip and these controls move into the page header band,
+								     which is empty there and has the width for them; the pane below keeps only
+								     the content. -->
+								{#if !fullscreen}
+									<!-- Open-in-full-page + full-screen toggle, floating over the top-right
+									     corner to mirror the collapse control. Its width is measured so the strip
+									     can reserve room and its tabs never scroll underneath. -->
+									<div
+										bind:clientWidth={previewActionsWidth}
+										class="absolute top-0 right-1 z-30 flex h-8 items-center gap-0.5"
 									>
-										{#if fullscreen}
-											<Minimize2 size={14} />
-										{:else}
-											<Maximize2 size={14} />
-										{/if}
-									</button>
-								</div>
+										{@render previewControls()}
+									</div>
 
-								<!-- Tab strip: open preview pages, shared with the raw-app editor
-								     (DraggableTabs). Clicking the active tab (label or accessory chevron)
-								     toggles its breadcrumb picker; the "+" trailing opens the router picker.
-								     Left/right padding clears the floating collapse/fullscreen buttons. -->
-								<DraggableTabs
-									tabs={previewTabItems}
-									activeId={owner?.activeId ?? ''}
-									onSelect={selectTab}
-									onActiveClick={() => (activeTabPickerOpen = !activeTabPickerOpen)}
-									onClose={closeTab}
-									onReorder={reorderTabs}
-									class="session-preview-tab-strip h-8 border-b border-light bg-surface-secondary/50 {fullscreen
-										? 'pl-1.5'
-										: 'pl-9'} pr-[var(--preview-actions-w,4rem)]"
-								>
-									{#snippet tabAccessory(_tab, isActive)}
-										{#if isActive}
-											<!-- Any active-tab click toggles the picker (`onActiveClick`); the tab
-										     is excluded from pointerdown-outside so toggle doesn't race close.
-										     The trigger is an inert whole-tab overlay (anchor only — clickable
-										     would break dnd reorder); the chevron is purely visual. -->
-											<Popover
-												placement="bottom-start"
-												usePointerDownOutside
-												excludeSelectors=".drawer, .session-preview-tab-strip [role='tab'][aria-selected='true']"
-												disableFocusTrap
-												closeOnOtherPopoverOpen
-												enableFlyTransition
-												bind:isOpen={activeTabPickerOpen}
-												openFocus="[data-workspace-picker-search]"
-												contentClasses="flex flex-col overflow-hidden"
-												class="absolute inset-0 pointer-events-none"
-												triggerAttrs={{
-													'aria-label': 'Change preview',
-													tabindex: -1,
-													// The inert trigger only ever receives focus from melt's
-													// close-time restore; hand it straight to the tab so
-													// arrow/Delete tab shortcuts keep working.
-													onfocus: (e: FocusEvent) =>
-														(e.currentTarget as HTMLElement)
-															.closest<HTMLElement>('[role="tab"]')
-															?.focus()
-												}}
-											>
-												{#snippet content()}
-													<!-- The picker snapshots its scope at mount, but `friendlyPath` is
-												     stamped async once the editor cell loads — a picker opened
-												     before the stamp is scoped to the `draft_<uuid>` storage
-												     folder while the tree groups the draft under its friendly
-												     folder. Remount on the scope dir so it re-lands on the item. -->
-													{#key activePickerScope?.dir ?? ''}
-														<PreviewRouterPicker
-															initialScope={activePickerScope}
-															initialHighlight={activePickerHighlight}
-															{currentItem}
-															workspaceId={previewWorkspace}
-															artifacts={sessionArtifacts}
-															onPick={(t) => {
-																activeTabPickerOpen = false
-																navigatePreviewTo(t)
-															}}
-														/>
-													{/key}
-												{/snippet}
-											</Popover>
-											<ChevronDown
-												size={12}
-												class="shrink-0 text-tertiary group-hover:text-primary"
-											/>
-										{/if}
-									{/snippet}
-									{#snippet afterTabs()}
-										<Popover
-											placement="bottom-start"
-											usePointerDownOutside
-											excludeSelectors=".drawer"
-											disableFocusTrap
-											closeOnOtherPopoverOpen
-											bind:isOpen={newTabOpen}
-											enableFlyTransition
-											openFocus="[data-workspace-picker-search]"
-											contentClasses="flex flex-col overflow-hidden"
-											class="shrink-0 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover cursor-pointer"
-										>
-											{#snippet trigger()}
-												<Plus size={14} />
-											{/snippet}
-											{#snippet content()}
-												<PreviewRouterPicker
-													workspaceId={previewWorkspace}
-													artifacts={sessionArtifacts}
-													onPick={(t) => {
-														newTabOpen = false
-														openInNewTab(t)
-													}}
-												/>
-											{/snippet}
-										</Popover>
-									{/snippet}
-								</DraggableTabs>
+									{@render previewTabStrip(false)}
+								{/if}
 
 								<!-- One host per tab of every warm session, stacked and
 								     visibility-toggled so switching tabs or sessions never reloads
@@ -1250,21 +1268,6 @@
 						</div>
 					</Pane>
 				</Splitpanes>
-				{#if previewCollapsed && !fullscreen}
-					<!-- Collapsed preview: no rail — a floating launcher in the top-right to
-				     reopen the side panel. -->
-					<div class="absolute top-2 right-3 z-50">
-						<Button
-							variant="subtle"
-							unifiedSize="sm"
-							startIcon={{ icon: PanelRightOpen }}
-							title="Open side panel"
-							onclick={() => owner?.setCollapsed(false)}
-						>
-							Open side panel
-						</Button>
-					</div>
-				{/if}
 			</div>
 			{#if aiHiddenVerdict === undefined}
 				<div class="absolute inset-0 z-20 flex items-center justify-center bg-surface">
@@ -1285,6 +1288,149 @@
 	{/if}
 </div>
 
+<!-- The strip and the preview's own controls render in two places: in the panel, where they
+     are a row above the pane; and in full screen, inside the band's filling surface. Written
+     once so the two cannot drift. -->
+{#snippet previewControls()}
+	{#if activeWorkspaceHref}
+		<a
+			href={withWorkspaceParam(activeWorkspaceHref, previewWorkspace)}
+			title="Open in workspace"
+			aria-label="Open in workspace"
+			class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
+		>
+			<ExternalLink size={14} />
+		</a>
+	{/if}
+	{#if fullscreen}
+		<!-- Named rather than an icon alone: full screen hid the chat, and what the user wants back
+		     is the chat, not a window size. The band has the room for the word. -->
+		<button
+			type="button"
+			onclick={toggleFullscreen}
+			title="Back to chat"
+			class="inline-flex items-center gap-1.5 h-6 pl-1.5 pr-2 rounded text-xs text-tertiary hover:text-primary hover:bg-surface-hover"
+		>
+			<Minimize2 size={14} />
+			Chat
+		</button>
+	{:else}
+		<button
+			type="button"
+			onclick={toggleFullscreen}
+			title="Full screen"
+			aria-label="Full screen"
+			class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
+		>
+			<Maximize2 size={14} />
+		</button>
+	{/if}
+{/snippet}
+
+{#snippet previewTabStrip(inBand: boolean)}
+	<!-- Both layouts render this one snippet, so the strip is described once. The wrapper is here to
+	     own its fade: the two strips stand in different places, and what carries the switch is the
+	     panel moving under them, not the strip travelling. -->
+	<div
+		class={inBand ? 'flex items-center h-full min-w-0' : 'shrink-0'}
+		in:stripArrive
+		out:stripLeave
+	>
+		<DraggableTabs
+			tabs={previewTabItems}
+			activeId={owner?.activeId ?? ''}
+			onSelect={selectTab}
+			onActiveClick={() => (activeTabPickerOpen = !activeTabPickerOpen)}
+			onClose={closeTab}
+			onReorder={reorderTabs}
+			size={inBand ? 'md' : 'sm'}
+			class={inBand
+				? 'session-preview-tab-strip h-full bg-transparent min-w-0'
+				: 'session-preview-tab-strip h-8 border-b border-light bg-surface-secondary/50 pl-9 pr-[var(--preview-actions-w,4rem)]'}
+		>
+			{#snippet tabAccessory(_tab, isActive)}
+				{#if isActive}
+					<!-- Any active-tab click toggles the picker (`onActiveClick`); the tab
+				     is excluded from pointerdown-outside so toggle doesn't race close.
+				     The trigger is an inert whole-tab overlay (anchor only — clickable
+				     would break dnd reorder); the chevron is purely visual. -->
+					<Popover
+						placement="bottom-start"
+						usePointerDownOutside
+						excludeSelectors=".drawer, .session-preview-tab-strip [role='tab'][aria-selected='true']"
+						disableFocusTrap
+						closeOnOtherPopoverOpen
+						enableFlyTransition
+						bind:isOpen={activeTabPickerOpen}
+						openFocus="[data-workspace-picker-search]"
+						contentClasses="flex flex-col overflow-hidden"
+						class="absolute inset-0 pointer-events-none"
+						triggerAttrs={{
+							'aria-label': 'Change preview',
+							tabindex: -1,
+							// The inert trigger only ever receives focus from melt's
+							// close-time restore; hand it straight to the tab so
+							// arrow/Delete tab shortcuts keep working.
+							onfocus: (e: FocusEvent) =>
+								(e.currentTarget as HTMLElement).closest<HTMLElement>('[role="tab"]')?.focus()
+						}}
+					>
+						{#snippet content()}
+							<!-- The picker snapshots its scope at mount, but `friendlyPath` is
+						     stamped async once the editor cell loads — a picker opened
+						     before the stamp is scoped to the `draft_<uuid>` storage
+						     folder while the tree groups the draft under its friendly
+						     folder. Remount on the scope dir so it re-lands on the item. -->
+							{#key activePickerScope?.dir ?? ''}
+								<PreviewRouterPicker
+									initialScope={activePickerScope}
+									initialHighlight={activePickerHighlight}
+									{currentItem}
+									workspaceId={previewWorkspace}
+									artifacts={sessionArtifacts}
+									onPick={(t) => {
+										activeTabPickerOpen = false
+										navigatePreviewTo(t)
+									}}
+								/>
+							{/key}
+						{/snippet}
+					</Popover>
+					<ChevronDown size={12} class="shrink-0 text-tertiary group-hover:text-primary" />
+				{/if}
+			{/snippet}
+			{#snippet afterTabs()}
+				<Popover
+					placement="bottom-start"
+					usePointerDownOutside
+					excludeSelectors=".drawer"
+					disableFocusTrap
+					closeOnOtherPopoverOpen
+					bind:isOpen={newTabOpen}
+					enableFlyTransition
+					openFocus="[data-workspace-picker-search]"
+					contentClasses="flex flex-col overflow-hidden"
+					class="shrink-0 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover cursor-pointer"
+				>
+					{#snippet trigger()}
+						<Plus size={14} />
+					{/snippet}
+					{#snippet content()}
+						<PreviewRouterPicker
+							workspaceId={previewWorkspace}
+							artifacts={sessionArtifacts}
+							onPick={(t) => {
+								newTabOpen = false
+								openInNewTab(t)
+							}}
+						/>
+					{/snippet}
+				</Popover>
+			{/snippet}
+		</DraggableTabs>
+	</div>
+{/snippet}
+
 <style>
 	/* Draggable gutter between the chat and the preview: a real (layout-occupying)
 	   10px-wide grab zone, no overlap tricks that could cover the chat's scrollbar
@@ -1307,6 +1453,16 @@
 		border-radius: 9999px !important;
 	}
 
+	/* The full-screen switch is the preview panel expanding to the left over the chat column, so
+	   the panes' widths are animated — but only while that switch is in flight (`panes-animating`),
+	   since a splitter drag sets the same inline width and would trail the pointer. */
+	:global(.splitpanes--vertical.panes-animating) > :global(.splitpanes__pane) {
+		/* The duration comes from PANES_MOVE_MS, which also times how long the class stays on.
+		   `!important` to beat app.css's blanket `transition: none !important` on vertical panes,
+		   which is there so a splitter drag tracks the pointer exactly. */
+		transition: width var(--panes-move) cubic-bezier(0.33, 1, 0.68, 1) !important;
+	}
+
 	/* Collapsed preview: the pane is resized to 0 but stays mounted, so remove
 	   the gutter entirely — it would otherwise leave a dead 10px drag zone on the
 	   chat's right edge. */
diff --git a/frontend/src/routes/(root)/(logged)/svix/create-webhook/+page@(root).svelte b/frontend/src/routes/(root)/(logged)/svix/create-webhook/+page@(root).svelte
index d4ac558cb8..212696782b 100644
--- a/frontend/src/routes/(root)/(logged)/svix/create-webhook/+page@(root).svelte
+++ b/frontend/src/routes/(root)/(logged)/svix/create-webhook/+page@(root).svelte
@@ -4,6 +4,8 @@
 	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
 	import { Button } from '$lib/components/common'
 	import { page } from '$app/stores'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
+	import InstanceUiSync from '$lib/components/InstanceUiSync.svelte'
 	import { userStore, workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import UserSettings from '$lib/components/UserSettings.svelte'
@@ -26,11 +28,11 @@
 			let webhook: string
 			switch (kind) {
 				case 'script':
-					webhook = `${$page.url.origin}/api/w/${$workspaceStore}/jobs/run/p/${path}`
+					webhook = `${apiBaseUrl()}/api/w/${$workspaceStore}/jobs/run/p/${path}`
 					redirectSuccess(webhook, token)
 					break
 				case 'flow':
-					webhook = `${$page.url.origin}/api/w/${$workspaceStore}/jobs/run/f/${path}`
+					webhook = `${apiBaseUrl()}/api/w/${$workspaceStore}/jobs/run/f/${path}`
 					redirectSuccess(webhook, token)
 					break
 				default:
@@ -72,6 +74,8 @@
 	})
 </script>
 
+<!-- This page skips the logged layout, which is what normally loads the API base url. -->
+<InstanceUiSync />
 <UserSettings
 	bind:this={userSettings}
 	on:tokenCreated={(e) => {
diff --git a/frontend/src/routes/(root)/(logged)/user/(user)/fork_workspace/+page.svelte b/frontend/src/routes/(root)/(logged)/user/(user)/fork_workspace/+page.svelte
index c98509f3db..3be417202c 100644
--- a/frontend/src/routes/(root)/(logged)/user/(user)/fork_workspace/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/(user)/fork_workspace/+page.svelte
@@ -1,5 +1,17 @@
 <script lang="ts">
-	import CreateWorkspace from "$lib/components/workspaceSettings/CreateWorkspace.svelte"
+	import CreateWorkspace from '$lib/components/workspaceSettings/CreateWorkspace.svelte'
+	import { Alert } from '$lib/components/common'
+	import { userStore } from '$lib/stores'
 </script>
 
-<CreateWorkspace isFork={true}/>
+<!-- The form is reachable by URL whatever the pickers show, and forking is what turns an operator
+     into a full member of the copy (the fork's membership row carries `is_admin` but not
+     `operator`). The server still accepts the call — this refuses the page, it does not enforce
+     the rule; see docs/operator-write-rights.md. -->
+{#if $userStore?.operator}
+	<div class="p-4 mt-12">
+		<Alert type="error" title="Unauthorized">Page not available for operators</Alert>
+	</div>
+{:else}
+	<CreateWorkspace isFork={true} />
+{/if}
diff --git a/frontend/src/routes/(root)/(logged)/user/(user)/logout/+page@.svelte b/frontend/src/routes/(root)/(logged)/user/(user)/logout/+page@.svelte
index 75e31a9a00..c9623bc340 100644
--- a/frontend/src/routes/(root)/(logged)/user/(user)/logout/+page@.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/(user)/logout/+page@.svelte
@@ -1,4 +1,6 @@
 <script lang="ts">
+	// Resets to the root layout, which does not import it.
+	import '$lib/assets/app.css'
 	import { page } from '$app/state'
 	import CenteredModal from '$lib/components/CenteredModal.svelte'
 	import { clearUser } from '$lib/logout'
diff --git a/frontend/src/routes/(root)/(logged)/user/cli-success/+page.svelte b/frontend/src/routes/(root)/(logged)/user/cli-success/+page.svelte
index 645a928473..408a2c1d55 100644
--- a/frontend/src/routes/(root)/(logged)/user/cli-success/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/cli-success/+page.svelte
@@ -8,4 +8,4 @@
 	goto('/')
 </script>
 
-<CenteredModal title="Redirecting to Home" loading={true}></CenteredModal>
+<CenteredModal title="Redirecting to Home" loading={true} inPage></CenteredModal>
diff --git a/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte b/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte
index 010abe2bd8..6e5f674b44 100644
--- a/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte
@@ -30,7 +30,7 @@
 	}
 </script>
 
-<CenteredModal title="Authorize login request">
+<CenteredModal title="Authorize login request" inPage>
 	<p class="text-center text-lg mb-6">
 		Token will be posted to {host == 'localhost' ? 'your local machine' : host} to port {port}
 	</p>
diff --git a/frontend/src/routes/(root)/(logged)/user/remote_deploy_authorize/+page.svelte b/frontend/src/routes/(root)/(logged)/user/remote_deploy_authorize/+page.svelte
index 2362b7f116..ae22b66147 100644
--- a/frontend/src/routes/(root)/(logged)/user/remote_deploy_authorize/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/remote_deploy_authorize/+page.svelte
@@ -73,7 +73,7 @@
 	}
 </script>
 
-<CenteredModal title="Authorize a deploy connection">
+<CenteredModal title="Authorize a deploy connection" inPage>
 	{#if framed}
 		<Alert type="error" title="Refused">
 			This page cannot be used inside another page. Open it in its own tab.
diff --git a/frontend/src/routes/(root)/(logged)/workers/+page.svelte b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
index f7e0f07a54..0fb9243276 100644
--- a/frontend/src/routes/(root)/(logged)/workers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
@@ -1022,7 +1022,7 @@
 											</Cell>
 										</tr>
 										{#if workers}
-											{#each workers as { worker, custom_tags, last_ping, started_at, jobs_executed, last_job_id, last_job_workspace_id, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, occupancy_rate, wm_version, vcpus, memory, memory_usage, wm_memory_usage, native_mode }}
+											{#each workers as { worker, custom_tags, last_ping, started_at, jobs_executed, last_job_id, last_job_workspace_id, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, occupancy_rate, wm_version, vcpus, memory, memory_usage, wm_memory_usage, native_mode, draining }}
 												{@const isWorkerAlive = isWorkerMaybeAlive(last_ping)}
 												{@const tagMismatchInfo = getTagMismatchInfo(
 													custom_tags,
@@ -1087,6 +1087,15 @@
 															{#if native_mode}
 																<Badge color="blue" small>Native</Badge>
 															{/if}
+															{#if draining}
+																<MeltTooltip>
+																	<Badge color="yellow" small>Draining</Badge>
+																	{#snippet text()}
+																		This worker received a shutdown signal. It no longer pulls jobs
+																		and exits once its current job is done.
+																	{/snippet}
+																</MeltTooltip>
+															{/if}
 														</div>
 													</Cell>
 													{#if !config || !config.worker_tags || config.worker_tags.length === 0}
diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
index f055e92ca3..1eda558a4a 100644
--- a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
@@ -3,7 +3,7 @@
 	import { page } from '$app/stores'
 	import { isCloudHosted } from '$lib/cloud'
 	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Button, CopyButton, Section, Skeleton, Tab, Tabs } from '$lib/components/common'
+	import { Alert, Button, Section, Skeleton, Tab, Tabs } from '$lib/components/common'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 
@@ -13,7 +13,7 @@
 	import ErrorOrRecoveryHandler, {
 		handlerFullPath
 	} from '$lib/components/ErrorOrRecoveryHandler.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
 	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
 
 	import Tooltip from '$lib/components/Tooltip.svelte'
@@ -1457,26 +1457,31 @@
 					}
 				]
 	)
+
+	// The label of the entry the sidebar highlights, so the breadcrumb and the sidebar name the
+	// same pane: both read `tab`, which resolves the URL's aliases (`teams`, `deploy_to`, …).
+	const tabLabel = $derived(
+		navigationGroups.flatMap((g) => g.items).find((i) => i.id === tab)?.label
+	)
 </script>
 
-<CenteredPage wrapperClasses="pb-0 h-screen" handleOverflow={false} class="flex flex-col h-full">
+<CenteredPage wrapperClasses="pb-0 h-full" handleOverflow={false} class="flex flex-col h-full">
 	{#if canAdmin || isForkOwner}
-		<PageHeader title="Workspace settings: {$workspaceStore}">
-			{#snippet titleActions()}
-				{#if $workspaceStore}
-					<CopyButton value={$workspaceStore} title={`Copy id: ${$workspaceStore}`} />
-				{/if}
-			{/snippet}
-			{#if $superadmin}
-				<Button variant="default" size="sm" on:click={() => goto('#superadmin-settings')}>
-					Instance settings
-				</Button>
-			{/if}</PageHeader
-		>
+		<!-- No title of its own: the band already says which workspace's settings these are, and the
+		     two controls that sat beside the title are the page's actions. The panes below scroll
+		     inside themselves, so the bar keeps its edge at rest rather than only under a scroll. -->
+		<PageHeaderContent
+			section={tabLabel ? { parent: 'Workspace settings', label: tabLabel } : undefined}
+			actions={settingsActions}
+			separator="always"
+		/>
 
 		<div class="flex grow min-h-0 pb-4">
 			<!-- Sidebar Navigation -->
-			<div class="w-60 shrink-0 h-full overflow-auto pb-4 pr-4 -ml-2">
+			<!-- The top padding belongs inside both scrollers, not above them: it is the gap under the
+			     separator at rest, and it has to travel with the content so what scrolls passes under
+			     the line rather than stopping short of it. -->
+			<div class="w-60 shrink-0 h-full overflow-auto pt-6 pb-4 pr-4 -ml-2">
 				<SidebarNavigation
 					groups={navigationGroups}
 					selectedId={tab}
@@ -1491,7 +1496,7 @@
 			<!-- Main Content -->
 			<div class="flex-1 min-w-0 h-full">
 				<div class="h-full overflow-auto">
-					<div class="h-fit px-6" style="scrollbar-gutter: stable both-edges;">
+					<div class="h-fit px-6 pt-6" style="scrollbar-gutter: stable both-edges;">
 						{#if !loadedSettings}
 							<Skeleton layout={[1, [40]]} />
 						{:else if tab == 'users'}
@@ -2435,5 +2440,13 @@ export async function main(
 	tabMode={true}
 />
 
+{#snippet settingsActions()}
+	{#if $superadmin}
+		<Button variant="default" unifiedSize="sm" on:click={() => goto('#superadmin-settings')}>
+			Instance settings
+		</Button>
+	{/if}
+{/snippet}
+
 <style>
 </style>
diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/checkout/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/checkout/+page.svelte
index b25b8db5c8..62c25fc6b3 100644
--- a/frontend/src/routes/(root)/(logged)/workspace_settings/checkout/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workspace_settings/checkout/+page.svelte
@@ -31,7 +31,7 @@
 </script>
 
 <!-- svelte-ignore missing_declaration -->
-<CenteredModal title="Subscription upgrade {success ? 'succeeded' : 'failed'}">
+<CenteredModal title="Subscription upgrade {success ? 'succeeded' : 'failed'}" inPage>
 	{#if !success}
 		<div class="my-2">
 			<Alert type="error" title="Checkout failed">
diff --git a/frontend/src/routes/(root)/+layout.svelte b/frontend/src/routes/(root)/+layout.svelte
index 06d7d570b2..acc554c0a5 100644
--- a/frontend/src/routes/(root)/+layout.svelte
+++ b/frontend/src/routes/(root)/+layout.svelte
@@ -1,4 +1,6 @@
 <script lang="ts">
+	// First, so its rules precede every component's.
+	import '$lib/assets/app.css'
 	import { base } from '$app/paths'
 	import { goto } from '$lib/navigation'
 	import { page } from '$app/state'
diff --git a/frontend/src/routes/(styled)/+layout.svelte b/frontend/src/routes/(styled)/+layout.svelte
new file mode 100644
index 0000000000..ed3de92a31
--- /dev/null
+++ b/frontend/src/routes/(styled)/+layout.svelte
@@ -0,0 +1,9 @@
+<script lang="ts">
+	// The root layout leaves app.css to the layouts under it so that the public app routes
+	// can skip it; every other top-level route lives in this group to get it.
+	import '$lib/assets/app.css'
+
+	let { children }: { children?: import('svelte').Snippet } = $props()
+</script>
+
+{@render children?.()}
diff --git a/frontend/src/routes/app_embed/[workspace]/[...path]/+page.svelte b/frontend/src/routes/(styled)/app_embed/[workspace]/[...path]/+page.svelte
similarity index 81%
rename from frontend/src/routes/app_embed/[workspace]/[...path]/+page.svelte
rename to frontend/src/routes/(styled)/app_embed/[workspace]/[...path]/+page.svelte
index ee83869ee8..9b3a9c1e41 100644
--- a/frontend/src/routes/app_embed/[workspace]/[...path]/+page.svelte
+++ b/frontend/src/routes/(styled)/app_embed/[workspace]/[...path]/+page.svelte
@@ -78,23 +78,29 @@
 	}
 </script>
 
-<PublicAppFrame
-	{fetchEmbedToken}
-	onViewerReady={(_token, requestTokenRefresh) => {
-		refresh = requestTokenRefresh
-		loadApp()
-	}}
->
-	{#snippet viewer()}
-		<PublicApp
-			{app}
-			{workspace}
-			{notExists}
-			{noPermission}
-			jwtError={false}
-			inWorkspace
-			{hideRefreshBar}
-			onLoginSuccess={() => loadApp()}
-		></PublicApp>
-	{/snippet}
-</PublicAppFrame>
+<!-- Everything the viewer renders is `h-full`, so the route is what says how tall the app is:
+     nothing above it has a height (`app.html` wraps the body in `display: contents`), and an
+     unfloored app collapses to nothing. -->
+<div class="h-screen w-full">
+	<PublicAppFrame
+		{fetchEmbedToken}
+		onViewerReady={(_token, requestTokenRefresh) => {
+			refresh = requestTokenRefresh
+			loadApp()
+		}}
+	>
+		{#snippet viewer()}
+			<PublicApp
+				{app}
+				{workspace}
+				user={$userStore}
+				{notExists}
+				{noPermission}
+				jwtError={false}
+				inWorkspace
+				{hideRefreshBar}
+				onLoginSuccess={() => loadApp()}
+			></PublicApp>
+		{/snippet}
+	</PublicAppFrame>
+</div>
diff --git a/frontend/src/routes/approve/[workspace]/[job]/+page.svelte b/frontend/src/routes/(styled)/approve/[workspace]/[job]/+page.svelte
similarity index 100%
rename from frontend/src/routes/approve/[workspace]/[job]/+page.svelte
rename to frontend/src/routes/(styled)/approve/[workspace]/[job]/+page.svelte
diff --git a/frontend/src/routes/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte b/frontend/src/routes/(styled)/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte
similarity index 100%
rename from frontend/src/routes/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte
rename to frontend/src/routes/(styled)/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte
diff --git a/frontend/src/routes/dev/+page.js b/frontend/src/routes/(styled)/dev/+page.js
similarity index 100%
rename from frontend/src/routes/dev/+page.js
rename to frontend/src/routes/(styled)/dev/+page.js
diff --git a/frontend/src/routes/dev/+page.svelte b/frontend/src/routes/(styled)/dev/+page.svelte
similarity index 100%
rename from frontend/src/routes/dev/+page.svelte
rename to frontend/src/routes/(styled)/dev/+page.svelte
diff --git a/frontend/src/routes/flows/dev/+page.js b/frontend/src/routes/(styled)/flows/dev/+page.js
similarity index 100%
rename from frontend/src/routes/flows/dev/+page.js
rename to frontend/src/routes/(styled)/flows/dev/+page.js
diff --git a/frontend/src/routes/flows/dev/+page.svelte b/frontend/src/routes/(styled)/flows/dev/+page.svelte
similarity index 100%
rename from frontend/src/routes/flows/dev/+page.svelte
rename to frontend/src/routes/(styled)/flows/dev/+page.svelte
diff --git a/frontend/src/routes/gh_success/+page.svelte b/frontend/src/routes/(styled)/gh_success/+page.svelte
similarity index 100%
rename from frontend/src/routes/gh_success/+page.svelte
rename to frontend/src/routes/(styled)/gh_success/+page.svelte
diff --git a/frontend/src/routes/kitchen_sink/+page.svelte b/frontend/src/routes/(styled)/kitchen_sink/+page.svelte
similarity index 100%
rename from frontend/src/routes/kitchen_sink/+page.svelte
rename to frontend/src/routes/(styled)/kitchen_sink/+page.svelte
diff --git a/frontend/src/routes/kitchen_sink/deploy_animation/+page.svelte b/frontend/src/routes/(styled)/kitchen_sink/deploy_animation/+page.svelte
similarity index 100%
rename from frontend/src/routes/kitchen_sink/deploy_animation/+page.svelte
rename to frontend/src/routes/(styled)/kitchen_sink/deploy_animation/+page.svelte
diff --git a/frontend/src/routes/kitchen_sink/icons/+page.svelte b/frontend/src/routes/(styled)/kitchen_sink/icons/+page.svelte
similarity index 100%
rename from frontend/src/routes/kitchen_sink/icons/+page.svelte
rename to frontend/src/routes/(styled)/kitchen_sink/icons/+page.svelte
diff --git a/frontend/src/routes/kitchen_sink/login/+page.svelte b/frontend/src/routes/(styled)/kitchen_sink/login/+page.svelte
similarity index 100%
rename from frontend/src/routes/kitchen_sink/login/+page.svelte
rename to frontend/src/routes/(styled)/kitchen_sink/login/+page.svelte
diff --git a/frontend/src/routes/oauth/callback/[client_name]/+page.svelte b/frontend/src/routes/(styled)/oauth/callback/[client_name]/+page.svelte
similarity index 100%
rename from frontend/src/routes/oauth/callback/[client_name]/+page.svelte
rename to frontend/src/routes/(styled)/oauth/callback/[client_name]/+page.svelte
diff --git a/frontend/src/routes/oauth/callback_slack/+page.svelte b/frontend/src/routes/(styled)/oauth/callback_slack/+page.svelte
similarity index 100%
rename from frontend/src/routes/oauth/callback_slack/+page.svelte
rename to frontend/src/routes/(styled)/oauth/callback_slack/+page.svelte
diff --git a/frontend/src/routes/oauth/callback_slack/instance/+page.svelte b/frontend/src/routes/(styled)/oauth/callback_slack/instance/+page.svelte
similarity index 100%
rename from frontend/src/routes/oauth/callback_slack/instance/+page.svelte
rename to frontend/src/routes/(styled)/oauth/callback_slack/instance/+page.svelte
diff --git a/frontend/src/routes/oauth/callback_supabase/+page.svelte b/frontend/src/routes/(styled)/oauth/callback_supabase/+page.svelte
similarity index 100%
rename from frontend/src/routes/oauth/callback_supabase/+page.svelte
rename to frontend/src/routes/(styled)/oauth/callback_supabase/+page.svelte
diff --git a/frontend/src/routes/pipeline_dev/+page.svelte b/frontend/src/routes/(styled)/pipeline_dev/+page.svelte
similarity index 100%
rename from frontend/src/routes/pipeline_dev/+page.svelte
rename to frontend/src/routes/(styled)/pipeline_dev/+page.svelte
diff --git a/frontend/src/routes/public_run/[workspace]/[id]/+page.svelte b/frontend/src/routes/(styled)/public_run/[workspace]/[id]/+page.svelte
similarity index 100%
rename from frontend/src/routes/public_run/[workspace]/[id]/+page.svelte
rename to frontend/src/routes/(styled)/public_run/[workspace]/[id]/+page.svelte
diff --git a/frontend/src/routes/replay/+page.svelte b/frontend/src/routes/(styled)/replay/+page.svelte
similarity index 100%
rename from frontend/src/routes/replay/+page.svelte
rename to frontend/src/routes/(styled)/replay/+page.svelte
diff --git a/frontend/src/routes/scripts/dev/+page.js b/frontend/src/routes/(styled)/scripts/dev/+page.js
similarity index 100%
rename from frontend/src/routes/scripts/dev/+page.js
rename to frontend/src/routes/(styled)/scripts/dev/+page.js
diff --git a/frontend/src/routes/scripts/dev/+page.svelte b/frontend/src/routes/(styled)/scripts/dev/+page.svelte
similarity index 100%
rename from frontend/src/routes/scripts/dev/+page.svelte
rename to frontend/src/routes/(styled)/scripts/dev/+page.svelte
diff --git a/frontend/src/routes/scripts/p/[...path].svelte b/frontend/src/routes/(styled)/scripts/p/[...path].svelte
similarity index 100%
rename from frontend/src/routes/scripts/p/[...path].svelte
rename to frontend/src/routes/(styled)/scripts/p/[...path].svelte
diff --git a/frontend/src/routes/test_dev/+layout.svelte b/frontend/src/routes/(styled)/test_dev/+layout.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/+layout.svelte
rename to frontend/src/routes/(styled)/test_dev/+layout.svelte
diff --git a/frontend/src/routes/test_dev/TestDevHeader.svelte b/frontend/src/routes/(styled)/test_dev/TestDevHeader.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/TestDevHeader.svelte
rename to frontend/src/routes/(styled)/test_dev/TestDevHeader.svelte
diff --git a/frontend/src/routes/test_dev/diff-comparison/+page.svelte b/frontend/src/routes/(styled)/test_dev/diff-comparison/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/diff-comparison/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/diff-comparison/+page.svelte
diff --git a/frontend/src/routes/test_dev/kitchen_sink/+page.svelte b/frontend/src/routes/(styled)/test_dev/kitchen_sink/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/kitchen_sink/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/kitchen_sink/+page.svelte
diff --git a/frontend/src/routes/test_dev/public_app_imports/+page.svelte b/frontend/src/routes/(styled)/test_dev/public_app_imports/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/public_app_imports/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/public_app_imports/+page.svelte
diff --git a/frontend/src/routes/test_dev/sdk_app/+page.svelte b/frontend/src/routes/(styled)/test_dev/sdk_app/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/sdk_app/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/sdk_app/+page.svelte
diff --git a/frontend/src/routes/test_dev/sdk_flow/+page.svelte b/frontend/src/routes/(styled)/test_dev/sdk_flow/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/sdk_flow/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/sdk_flow/+page.svelte
diff --git a/frontend/src/routes/test_dev/sdk_resource/+page.svelte b/frontend/src/routes/(styled)/test_dev/sdk_resource/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/sdk_resource/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/sdk_resource/+page.svelte
diff --git a/frontend/src/routes/test_dev/sdk_schema/+page.svelte b/frontend/src/routes/(styled)/test_dev/sdk_schema/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/sdk_schema/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/sdk_schema/+page.svelte
diff --git a/frontend/src/routes/test_dev/sdk_script/+page.svelte b/frontend/src/routes/(styled)/test_dev/sdk_script/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/sdk_script/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/sdk_script/+page.svelte
diff --git a/frontend/src/routes/test_dev/test_dev_script/+page.svelte b/frontend/src/routes/(styled)/test_dev/test_dev_script/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/test_dev_script/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/test_dev_script/+page.svelte
diff --git a/frontend/src/routes/user/close/+page.svelte b/frontend/src/routes/(styled)/user/close/+page.svelte
similarity index 100%
rename from frontend/src/routes/user/close/+page.svelte
rename to frontend/src/routes/(styled)/user/close/+page.svelte
diff --git a/frontend/src/routes/user/forgot-password/+page.svelte b/frontend/src/routes/(styled)/user/forgot-password/+page.svelte
similarity index 100%
rename from frontend/src/routes/user/forgot-password/+page.svelte
rename to frontend/src/routes/(styled)/user/forgot-password/+page.svelte
diff --git a/frontend/src/routes/user/login_callback/[client_name]/+page.svelte b/frontend/src/routes/(styled)/user/login_callback/[client_name]/+page.svelte
similarity index 100%
rename from frontend/src/routes/user/login_callback/[client_name]/+page.svelte
rename to frontend/src/routes/(styled)/user/login_callback/[client_name]/+page.svelte
diff --git a/frontend/src/routes/user/login_link_expired/+page.svelte b/frontend/src/routes/(styled)/user/login_link_expired/+page.svelte
similarity index 100%
rename from frontend/src/routes/user/login_link_expired/+page.svelte
rename to frontend/src/routes/(styled)/user/login_link_expired/+page.svelte
diff --git a/frontend/src/routes/user/reset-password/+page.svelte b/frontend/src/routes/(styled)/user/reset-password/+page.svelte
similarity index 100%
rename from frontend/src/routes/user/reset-password/+page.svelte
rename to frontend/src/routes/(styled)/user/reset-password/+page.svelte
diff --git a/frontend/src/routes/view_graph/+page.svelte b/frontend/src/routes/(styled)/view_graph/+page.svelte
similarity index 100%
rename from frontend/src/routes/view_graph/+page.svelte
rename to frontend/src/routes/(styled)/view_graph/+page.svelte
diff --git a/frontend/src/routes/+layout.svelte b/frontend/src/routes/+layout.svelte
index fca03d39ec..bc3d9f09cb 100644
--- a/frontend/src/routes/+layout.svelte
+++ b/frontend/src/routes/+layout.svelte
@@ -1,8 +1,17 @@
+<script module lang="ts">
+	// app.css is imported by the layouts below this one, not here: the public app routes
+	// (`public/`, `a/`) load it only when they render more than a raw app's bundle.
+	// A production build links a layout's CSS ahead of its page's, but in dev a stylesheet
+	// lands when its module evaluates, and a page's can evaluate before its layout's. This
+	// module is imported at startup, so loading it here in dev keeps app.css first.
+	if (import.meta.env.DEV && !/^\/(public|a)\//.test(location.pathname)) {
+		import('$lib/assets/app.css')
+	}
+</script>
+
 <script lang="ts">
 	import { page } from '$app/state'
 
-	import { SvelteToast } from '@zerodevx/svelte-toast'
-	import '$lib/assets/app.css'
 	import { installDevPollingDormancy } from '$lib/utils/devPollingDormancy'
 	interface Props {
 		children?: import('svelte').Snippet
@@ -65,7 +74,9 @@
 {@render children?.()}
 
 <div class="wrap">
-	<SvelteToast options={toastOptions} />
+	{#await import('@zerodevx/svelte-toast') then { SvelteToast }}
+		<SvelteToast options={toastOptions} />
+	{/await}
 </div>
 
 <style>
diff --git a/frontend/src/routes/a/[...path]/+page.svelte b/frontend/src/routes/a/[...path]/+page.svelte
index e9fd20877c..d9affb4723 100644
--- a/frontend/src/routes/a/[...path]/+page.svelte
+++ b/frontend/src/routes/a/[...path]/+page.svelte
@@ -1,19 +1,23 @@
 <script lang="ts">
 	import { BROWSER } from 'esm-env'
 
-	import { AppService, OpenAPI, type AppWithLastVersion } from '$lib/gen'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { sendUserToast } from '$lib/toast'
-
-	import { setLicense } from '$lib/enterpriseUtils'
-
-	import { getUserExt } from '$lib/user'
+	import { OpenAPI } from '$lib/gen/core/OpenAPI'
+	import type { GuestEntry } from '$lib/gen/types.gen'
+	import type { UserExt } from '$lib/stores'
 	import { page } from '$app/state'
 	import { base } from '$lib/base'
 	import PublicApp from '$lib/components/apps/editor/PublicApp.svelte'
 	import PublicAppFrame from '$lib/components/apps/editor/PublicAppFrame.svelte'
+	import {
+		getLicenseOrUndefined,
+		getUserExtOrUndefined,
+		publicGet,
+		type PublicAppValue
+	} from '$lib/components/apps/editor/publicAppApi'
 
-	let app: (AppWithLastVersion & { value: any }) | undefined = $state(undefined)
+	let app: PublicAppValue | undefined = $state(undefined)
+	let user: UserExt | undefined = $state(undefined)
+	let license: string | undefined = $state(undefined)
 	let notExists = $state(false)
 	let noPermission = $state(false)
 	let jwtError = $state(false)
@@ -73,6 +77,7 @@
 	const viewerUrl = `${base}/a/${parsedCustomPath.path}${page.url.search}${page.url.hash}`
 
 	let workspace: string | undefined = $state(undefined)
+	let embedWorkspace: string | undefined
 	let refresh: (() => void) | undefined
 	/** `<workspace>/<app_path>` when this app is open to guests. Resolved eagerly:
 	 * PublicAppFrame renders its sign-in gate before `onViewerReady` fires. */
@@ -92,9 +97,9 @@
 		if (guestEntrySettled()) return
 		for (let attempt = 0; attempt < 3; attempt++) {
 			try {
-				const entry = await AppService.getGuestEntryByCustomPath({
-					customPath: parsedCustomPath.path
-				})
+				const entry = await publicGet<GuestEntry>(
+					`/apps_u/guest_entry_by_custom_path/${encodeURI(parsedCustomPath.path)}`
+				)
 				guestAppPath = `${entry.workspace_id}/${entry.app_path}`
 				guestEntry = 'guest'
 				return
@@ -123,46 +128,41 @@
 		} else if (parsedCustomPath.jwt) {
 			OpenAPI.TOKEN = 'jwt_ext_' + parsedCustomPath.jwt
 		}
-		const headers: Record<string, string> = {}
-		if (typeof OpenAPI.TOKEN === 'string' && OpenAPI.TOKEN) {
-			headers['Authorization'] = `Bearer ${OpenAPI.TOKEN}`
-		}
 		const consent = opts?.sdkConsent ? '?sdk_consent=true' : ''
-		const res = await fetch(
-			`${OpenAPI.BASE}/apps_u/embed_token_by_custom_path/${parsedCustomPath.path}${consent}`,
-			{ headers }
+		const resp = await publicGet<{ token?: string; workspace_id?: string }>(
+			`/apps_u/embed_token_by_custom_path/${parsedCustomPath.path}${consent}`
 		)
-		if (!res.ok) {
-			const err: any = new Error('Failed to fetch embed token')
-			err.status = res.status
-			throw err
-		}
-		return await res.json()
+		embedWorkspace = resp.workspace_id ?? embedWorkspace
+		return resp
 	}
 
 	// Viewer side: load the app + user using the embed token handed to the iframe.
 	async function loadApp() {
 		try {
-			app = await AppService.getPublicAppByCustomPath({
-				customPath: parsedCustomPath.path
-			})
-			workspace = app.workspace_id
-			workspaceStore.set(app.workspace_id)
+			// The embed token names the workspace, so the user loads alongside the app
+			// rather than after it. The opaque viewer frame never fetches one.
+			const userLoad = embedWorkspace ? getUserExtOrUndefined(embedWorkspace) : undefined
+			const loaded = await publicGet<PublicAppValue>(
+				`/apps_u/public_app_by_custom_path/${encodeURI(parsedCustomPath.path)}`
+			)
+			const appWorkspace = loaded.workspace_id!
+			user = await (userLoad && embedWorkspace === appWorkspace
+				? userLoad
+				: getUserExtOrUndefined(appWorkspace))
+			import('$lib/stores').then(({ workspaceStore }) => workspaceStore.set(appWorkspace))
+			app = loaded
+			workspace = appWorkspace
 			noPermission = false
 			notExists = false
 			jwtError = false
-
-			try {
-				userStore.set(await getUserExt(app.workspace_id))
-				// A JWT in the custom path that fails to resolve a user is surfaced as a
-				// toast (matches the pre-sandbox custom-path viewer) rather than silently
-				// falling through to anonymous.
-				if (!$userStore && parsedCustomPath.jwt) {
-					jwtError = true
+			// A JWT in the custom path that fails to resolve a user is surfaced as a
+			// toast (matches the pre-sandbox custom-path viewer) rather than silently
+			// falling through to anonymous.
+			if (!user && parsedCustomPath.jwt) {
+				jwtError = true
+				import('$lib/toast').then(({ sendUserToast }) =>
 					sendUserToast('Could not authentify user with jwt token', true)
-				}
-			} catch (e) {
-				console.warn('Anonymous user')
+				)
 			}
 		} catch (e) {
 			if (e.status == 401) {
@@ -182,30 +182,37 @@
 	}
 
 	if (BROWSER) {
-		setLicense()
+		getLicenseOrUndefined().then((l) => (license = l))
 		loadGuestEntry()
 	}
 </script>
 
-<PublicAppFrame
-	{fetchEmbedToken}
-	{viewerUrl}
-	{guestAppPath}
-	{guestEntry}
-	onViewerReady={(_token, requestTokenRefresh) => {
-		refresh = requestTokenRefresh
-		loadApp()
-	}}
->
-	{#snippet viewer()}
-		<PublicApp
-			{workspace}
-			{notExists}
-			{noPermission}
-			{jwtError}
-			{guestAppPath}
-			{app}
-			onLoginSuccess={() => loadApp()}
-		></PublicApp>
-	{/snippet}
-</PublicAppFrame>
+<!-- The route is what gives the app a height: nothing above it has one (`app.html` wraps the
+     body in `display: contents`), and the viewer's own boxes are full-height. Styled
+     inline: a raw app renders here without app.css. -->
+<div style="height: 100vh; width: 100%">
+	<PublicAppFrame
+		{fetchEmbedToken}
+		{viewerUrl}
+		{guestAppPath}
+		{guestEntry}
+		onViewerReady={(_token, requestTokenRefresh) => {
+			refresh = requestTokenRefresh
+			loadApp()
+		}}
+	>
+		{#snippet viewer()}
+			<PublicApp
+				{workspace}
+				{user}
+				{license}
+				{notExists}
+				{noPermission}
+				{jwtError}
+				{guestAppPath}
+				{app}
+				onLoginSuccess={() => loadApp()}
+			></PublicApp>
+		{/snippet}
+	</PublicAppFrame>
+</div>
diff --git a/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte b/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
index b2a29b6316..31bc49a5ab 100644
--- a/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
+++ b/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
@@ -1,18 +1,23 @@
 <script lang="ts">
 	import { BROWSER } from 'esm-env'
 
-	import { AppService, OpenAPI, type AppWithLastVersion } from '$lib/gen'
-	import { userStore } from '$lib/stores'
-
-	import { setLicense } from '$lib/enterpriseUtils'
-
-	import { getUserExt } from '$lib/user'
+	import { OpenAPI } from '$lib/gen/core/OpenAPI'
+	import type { GuestEntry } from '$lib/gen/types.gen'
+	import type { UserExt } from '$lib/stores'
 	import { page } from '$app/state'
 	import { base } from '$lib/base'
 	import PublicApp from '$lib/components/apps/editor/PublicApp.svelte'
 	import PublicAppFrame from '$lib/components/apps/editor/PublicAppFrame.svelte'
+	import {
+		getLicenseOrUndefined,
+		getUserExtOrUndefined,
+		publicGet,
+		type PublicAppValue
+	} from '$lib/components/apps/editor/publicAppApi'
 
-	let app: (AppWithLastVersion & { value: any }) | undefined = $state(undefined)
+	let app: PublicAppValue | undefined = $state(undefined)
+	let user: UserExt | undefined = $state(undefined)
+	let license: string | undefined = $state(undefined)
 	let notExists = $state(false)
 	let noPermission = $state(false)
 	let jwtError = $state(false)
@@ -70,35 +75,21 @@
 		} else if (parsedSecret.jwt) {
 			OpenAPI.TOKEN = 'jwt_ext_' + parsedSecret.jwt
 		}
-		const headers: Record<string, string> = {}
-		if (typeof OpenAPI.TOKEN === 'string' && OpenAPI.TOKEN) {
-			headers['Authorization'] = `Bearer ${OpenAPI.TOKEN}`
-		}
 		const consent = opts?.sdkConsent ? '?sdk_consent=true' : ''
-		const res = await fetch(
-			`${OpenAPI.BASE}/w/${workspace}/apps_u/embed_token/${parsedSecret.secret}${consent}`,
-			{ headers }
-		)
-		if (!res.ok) {
-			const err: any = new Error('Failed to fetch embed token')
-			err.status = res.status
-			throw err
-		}
-		return await res.json()
+		return await publicGet(`/w/${workspace}/apps_u/embed_token/${parsedSecret.secret}${consent}`)
 	}
 
 	// Viewer side: load the app + user using the embed token handed to the iframe.
 	async function loadApp() {
+		// Neither waits on the other: `app.html` already requested both.
+		const userLoad = getUserExtOrUndefined(workspace)
+		const appLoad = publicGet<PublicAppValue>(
+			`/w/${workspace}/apps_u/public_app/${encodeURI(parsedSecret.secret)}`
+		)
+		appLoad.catch(() => {})
+		user = await userLoad
 		try {
-			userStore.set(await getUserExt(workspace))
-		} catch (e) {
-			console.warn('Anonymous user')
-		}
-		try {
-			app = await AppService.getPublicAppBySecret({
-				workspace,
-				path: parsedSecret.secret
-			})
+			app = await appLoad
 			noPermission = false
 			notExists = false
 		} catch (e) {
@@ -126,7 +117,9 @@
 		if (guestEntrySettled()) return
 		for (let attempt = 0; attempt < 3; attempt++) {
 			try {
-				const entry = await AppService.getGuestEntry({ workspace, path: parsedSecret.secret })
+				const entry = await publicGet<GuestEntry>(
+					`/w/${workspace}/apps_u/guest_entry/${encodeURI(parsedSecret.secret)}`
+				)
 				guestAppPath = `${workspace}/${entry.app_path}`
 				guestEntry = 'guest'
 				return
@@ -156,29 +149,36 @@
 	}
 
 	if (BROWSER) {
-		setLicense()
+		getLicenseOrUndefined().then((l) => (license = l))
 	}
 </script>
 
-<PublicAppFrame
-	{fetchEmbedToken}
-	{viewerUrl}
-	{guestAppPath}
-	{guestEntry}
-	onViewerReady={(_token, requestTokenRefresh) => {
-		refresh = requestTokenRefresh
-		loadApp()
-	}}
->
-	{#snippet viewer()}
-		<PublicApp
-			{app}
-			{workspace}
-			{notExists}
-			{noPermission}
-			{jwtError}
-			{guestAppPath}
-			onLoginSuccess={() => loadApp()}
-		></PublicApp>
-	{/snippet}
-</PublicAppFrame>
+<!-- The route is what gives the app a height: nothing above it has one (`app.html` wraps the
+     body in `display: contents`), and the viewer's own boxes are full-height. Styled
+     inline: a raw app renders here without app.css. -->
+<div style="height: 100vh; width: 100%">
+	<PublicAppFrame
+		{fetchEmbedToken}
+		{viewerUrl}
+		{guestAppPath}
+		{guestEntry}
+		onViewerReady={(_token, requestTokenRefresh) => {
+			refresh = requestTokenRefresh
+			loadApp()
+		}}
+	>
+		{#snippet viewer()}
+			<PublicApp
+				{app}
+				{workspace}
+				{user}
+				{license}
+				{notExists}
+				{noPermission}
+				{jwtError}
+				{guestAppPath}
+				onLoginSuccess={() => loadApp()}
+			></PublicApp>
+		{/snippet}
+	</PublicAppFrame>
+</div>
diff --git a/frontend/vite.config.js b/frontend/vite.config.js
index 5ae1e390e3..a07034d2c1 100644
--- a/frontend/vite.config.js
+++ b/frontend/vite.config.js
@@ -108,25 +108,34 @@ const isClientBuild = (bundle) =>
 	Object.keys(bundle).some((file) => file.startsWith('_app/immutable/'))
 
 /**
- * Fail the build if a public app URL statically loads the low-code runtime or monaco.
+ * Fail the build if a public app URL statically loads more than a raw app needs.
  *
  * These pages also serve raw apps, which only need a small shell around their bundle's
- * iframe. One static import of AppPreview (or of anything reaching monaco) makes every
- * public app page preload ~650 chunks instead of ~55. See loadAppPreview.ts.
+ * iframe, and the page shows nothing until its static imports have loaded. One static
+ * import of AppPreview (or of anything reaching monaco) makes every public app page
+ * preload ~650 chunks; one of the generated client, `$lib/stores` or `$lib/utils` drags
+ * in most of the app shell. The root layout wraps these pages, so it must not import
+ * app.css either. See loadAppPreview.ts and publicAppApi.ts.
  */
 function assertLeanPublicAppRoutes() {
 	// Route directories, so +page.js counts as well as +page.svelte.
 	const routes = ['/src/routes/public/[workspace]/[...secret]/', '/src/routes/a/[...path]/']
 	const forbidden = [
 		'/src/lib/components/apps/editor/AppPreview.svelte',
-		'/node_modules/monaco-editor/'
+		'/node_modules/monaco-editor/',
+		'/src/lib/assets/app.css',
+		'/src/lib/gen/services.gen.ts',
+		'/src/lib/stores.ts',
+		'/src/lib/utils.ts',
+		'/src/lib/components/Login.svelte',
+		'/node_modules/@melt-ui/'
 	]
 	return {
 		name: 'wm-assert-lean-public-app-routes',
 		generateBundle(_options, bundle) {
 			if (!isClientBuild(bundle)) return
-			for (const route of routes) {
-				assertStaticClosureExcludes(this, bundle, route, forbidden, 'loadAppPreview.ts')
+			for (const route of [...routes, '/src/routes/+layout.svelte']) {
+				assertStaticClosureExcludes(this, bundle, route, forbidden, 'publicAppApi.ts')
 			}
 		}
 	}
@@ -372,7 +381,19 @@ const config = {
 				// which makes the *chunk* graph cyclic where the module graph is not, and
 				// modules then evaluate against uninitialized bindings. See
 				// docs/frontend-import-cycles.md.
-				advancedChunks: { groups: [{ name: 'gen', test: /[\\/]src[\\/]lib[\\/]gen[\\/]/ }] }
+				// The client's config is split out for the public app routes, which set the
+				// credential without loading the client. It imports nothing at runtime, so
+				// its chunk cannot be part of a cycle.
+				advancedChunks: {
+					groups: [
+						{
+							name: 'gen-config',
+							test: /[\\/]src[\\/]lib[\\/]gen[\\/]core[\\/]OpenAPI\.ts$/,
+							priority: 1
+						},
+						{ name: 'gen', test: /[\\/]src[\\/]lib[\\/]gen[\\/]/ }
+					]
+				}
 			}
 		}
 	},
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 4509187f28..14c2eb8fac 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.827.0"
+wmill = ">=1.828.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index f44422946f..57f1fc5648 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.827.0
+  version: 1.828.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
@@ -145,7 +145,7 @@ components:
               description: Seconds to wait between retries
         exponential:
           type: object
-          description: Retry with exponential backoff (delay doubles each time)
+          description: "Retry with exponential backoff: the n-th retry waits multiplier × seconds^n"
           properties:
             attempts:
               type: integer
@@ -156,7 +156,7 @@ components:
             seconds:
               type: integer
               minimum: 1
-              description: Initial delay in seconds
+              description: Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too
             random_factor:
               type: integer
               minimum: 0
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 62cf4298d6..927edd49f6 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.827.0'
+    ModuleVersion     = '1.828.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 4ffcbddd89..13ac4753c5 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.827.0"
+version = "1.828.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill/wmill/client.py b/python-client/wmill/wmill/client.py
index 81e5b34e16..97da60aadc 100644
--- a/python-client/wmill/wmill/client.py
+++ b/python-client/wmill/wmill/client.py
@@ -196,12 +196,15 @@ class Windmill:
         args: dict = None,
         scheduled_in_secs: int = None,
         tag: str = None,
+        retry: dict = None,
     ) -> str:
         """Internal helper for running scripts asynchronously."""
         args = args or {}
         params = {"scheduled_in_secs": scheduled_in_secs} if scheduled_in_secs else {}
         if tag:
             params["tag"] = tag
+        if retry:
+            params["retry"] = json.dumps(retry)
         if os.environ.get("WM_JOB_ID"):
             params["parent_job"] = os.environ.get("WM_JOB_ID")
         if os.environ.get("WM_ROOT_FLOW_JOB_ID"):
@@ -222,9 +225,15 @@ class Windmill:
         args: dict = None,
         scheduled_in_secs: int = None,
         tag: str = None,
+        retry: dict = None,
     ) -> str:
-        """Create a script job by path and return its job id."""
-        return self._run_script_async_internal(path=path, args=args, scheduled_in_secs=scheduled_in_secs, tag=tag)
+        """Create a script job by path and return its job id.
+
+        ``retry`` re-runs the job when it fails, with the policy a schedule takes,
+        e.g. ``{"constant": {"attempts": 3, "seconds": 10}}``. The returned id is
+        the first attempt's; each retry is a job of its own, recorded as a child of it.
+        """
+        return self._run_script_async_internal(path=path, args=args, scheduled_in_secs=scheduled_in_secs, tag=tag, retry=retry)
 
     def run_script_by_hash_async(
         self,
@@ -232,9 +241,10 @@ class Windmill:
         args: dict = None,
         scheduled_in_secs: int = None,
         tag: str = None,
+        retry: dict = None,
     ) -> str:
-        """Create a script job by hash and return its job id."""
-        return self._run_script_async_internal(hash_=hash_, args=args, scheduled_in_secs=scheduled_in_secs, tag=tag)
+        """Create a script job by hash and return its job id. See ``run_script_by_path_async`` for ``retry``."""
+        return self._run_script_async_internal(hash_=hash_, args=args, scheduled_in_secs=scheduled_in_secs, tag=tag, retry=retry)
 
     def run_flow_async(
         self,
@@ -813,6 +823,22 @@ class Windmill:
         else:
             return r.json()
 
+    def worker_is_draining(self, job_id: Optional[str] = None) -> bool:
+        """Whether the worker running the job has received its shutdown signal.
+
+        A draining worker waits for its current job to finish before exiting. A long-running
+        script can poll this and return early so the worker can be replaced.
+
+        Args:
+            job_id: Job ID (defaults to current WM_JOB_ID)
+
+        Returns:
+            True if the worker running the job is draining
+        """
+        job_id = job_id or os.environ.get("WM_JOB_ID")
+
+        return self.get(f"/w/{self.workspace}/jobs/worker_is_draining/{job_id}").json()
+
     def set_flow_user_state(self, key: str, value: Any) -> None:
         """Set the user state of a flow at a given key"""
         flow_id = self.get_root_job_id()
@@ -1618,6 +1644,7 @@ def run_script_by_path_async(
     args: Dict[str, Any] = None,
     scheduled_in_secs: Union[None, int] = None,
     tag: str = None,
+    retry: Dict[str, Any] = None,
 ) -> str:
     """Create a script job by path and return its job ID.
 
@@ -1626,6 +1653,8 @@ def run_script_by_path_async(
         args: Script arguments
         scheduled_in_secs: Delay before execution in seconds
         tag: Override the worker tag the job runs on
+        retry: Re-run the job when it fails, with the policy a schedule takes,
+            e.g. ``{"constant": {"attempts": 3, "seconds": 10}}``
 
     Returns:
         Job ID string
@@ -1635,6 +1664,7 @@ def run_script_by_path_async(
         args=args,
         scheduled_in_secs=scheduled_in_secs,
         tag=tag,
+        retry=retry,
     )
 
 
@@ -1644,6 +1674,7 @@ def run_script_by_hash_async(
     args: Dict[str, Any] = None,
     scheduled_in_secs: Union[None, int] = None,
     tag: str = None,
+    retry: Dict[str, Any] = None,
 ) -> str:
     """Create a script job by hash and return its job ID.
 
@@ -1652,6 +1683,7 @@ def run_script_by_hash_async(
         args: Script arguments
         scheduled_in_secs: Delay before execution in seconds
         tag: Override the worker tag the job runs on
+        retry: Re-run the job when it fails, see ``run_script_by_path_async``
 
     Returns:
         Job ID string
@@ -1661,6 +1693,7 @@ def run_script_by_hash_async(
         args=args,
         scheduled_in_secs=scheduled_in_secs,
         tag=tag,
+        retry=retry,
     )
 
 
@@ -2010,6 +2043,17 @@ def get_progress(job_id: Optional[str] = None) -> Any:
     return _client.get_progress(job_id)
 
 
+@init_global_client
+def worker_is_draining(job_id: Optional[str] = None) -> bool:
+    """
+    Whether the worker running this job has received its shutdown signal.
+
+    A draining worker waits for its current job to finish before exiting. A long-running
+    script can poll this and return early so the worker can be replaced.
+    """
+    return _client.worker_is_draining(job_id)
+
+
 def set_shared_state_pickle(value: Any, path="state.pickle") -> None:
     """
     Set the state in the shared folder using pickle
diff --git a/rust-client/src/client.rs b/rust-client/src/client.rs
index 451dc58d85..bf47e7e95a 100644
--- a/rust-client/src/client.rs
+++ b/rust-client/src/client.rs
@@ -785,6 +785,7 @@ impl Windmill {
                 None,
                 None,
                 None,
+                None,
             )
             .await?
         } else {
@@ -808,6 +809,7 @@ impl Windmill {
                 None,
                 None,
                 None,
+                None,
             )
             .await?
         };
diff --git a/system_prompts/auto-generated/cli/cli-commands.md b/system_prompts/auto-generated/cli/cli-commands.md
index 7b13702da6..6fb6357b2b 100644
--- a/system_prompts/auto-generated/cli/cli-commands.md
+++ b/system_prompts/auto-generated/cli/cli-commands.md
@@ -727,6 +727,8 @@ user related commands
 
 **Subcommands:**
 
+- `user list` - List the users of the workspace
+  - `--json` - Output as JSON (for piping to jq)
 - `user add <email:string> [password:string]` - Create a user
   - `--superadmin` - Specify to make the new user superadmin.
   - `--company <company:string>` - Specify to set the company of the new user.
diff --git a/system_prompts/auto-generated/flow.md b/system_prompts/auto-generated/flow.md
index 7a965a17d8..e5dd862a3b 100644
--- a/system_prompts/auto-generated/flow.md
+++ b/system_prompts/auto-generated/flow.md
@@ -284,6 +284,10 @@ can call one, not an agent used as a tool.
 - `results.step_id.property` - Access specific property from a previous step output only when that step result is in scope
 - `flow_input.iter.value` - Current iteration value inside a `forloopflow`; in a `whileloopflow` it is just the iteration index (a plain number, same as `flow_input.iter.index`)
 - `flow_input.iter.index` - Current loop index when inside a loop (`forloopflow` or `whileloopflow`)
+- After a suspend step (approval), the next step's javascript expressions also get:
+  - `resume` - the last resume payload (the resume form values); with `continue_on_disapprove_timeout`, a disapproval or timeout yields `{ error: { name: "SuspendedDisapproved" | "SuspendedTimedOut", message } }` instead
+  - `resumes` - every resume payload, in arrival order
+  - `approvers` - a plain array of strings, one per resume: for a resume through the `resume`/`cancel` URL from `getResumeUrls(approver)`, the `approver` passed there if any; otherwise (including the `approvalPage` link) the resuming user's username, else `"anonymous"`, e.g. `approvers[0]`. It is NOT the `{ resume_id, approver }` objects stored in the flow status, so `approvers[0].approver` is always undefined
 
 ## Loop Structure Rules
 
@@ -594,4 +598,4 @@ Reference a specific resource using `$res:` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 8f6a2cc2c1..3884684646 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -311,6 +311,10 @@ can call one, not an agent used as a tool.
 - \`results.step_id.property\` - Access specific property from a previous step output only when that step result is in scope
 - \`flow_input.iter.value\` - Current iteration value inside a \`forloopflow\`; in a \`whileloopflow\` it is just the iteration index (a plain number, same as \`flow_input.iter.index\`)
 - \`flow_input.iter.index\` - Current loop index when inside a loop (\`forloopflow\` or \`whileloopflow\`)
+- After a suspend step (approval), the next step's javascript expressions also get:
+  - \`resume\` - the last resume payload (the resume form values); with \`continue_on_disapprove_timeout\`, a disapproval or timeout yields \`{ error: { name: "SuspendedDisapproved" | "SuspendedTimedOut", message } }\` instead
+  - \`resumes\` - every resume payload, in arrival order
+  - \`approvers\` - a plain array of strings, one per resume: for a resume through the \`resume\`/\`cancel\` URL from \`getResumeUrls(approver)\`, the \`approver\` passed there if any; otherwise (including the \`approvalPage\` link) the resuming user's username, else \`"anonymous"\`, e.g. \`approvers[0]\`. It is NOT the \`{ resume_id, approver }\` objects stored in the flow status, so \`approvers[0].approver\` is always undefined
 
 ## Loop Structure Rules
 
@@ -1186,10 +1190,48 @@ A **data pipeline** is NOT a flow. A flow is one runnable that orchestrates step
 A pipeline node that produces a table should almost always be a **\`duckdb\`** node that materializes its output into a **DuckLake** table with \`-- materialize ducklake://<name>/<table>\` (in a DuckDB node the annotation uses SQL \`--\` comment syntax; write the body as a bare \`SELECT\` and let the runtime do the write). DuckLake is the default lakehouse store for pipelines and is the shape the pipeline editor is built around, so prefer it unless the work specifically calls for something else:
 
 - \`postgresql\` / data tables — only for row-level, OLTP-style mutations against an existing Postgres data table (frequent single-row upserts/updates, transactional reads that an app queries live).
-- \`bun\` / \`python3\` — only for non-tabular work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node still produces tabular data for downstream steps, land it in DuckLake (write it with the wmill SDK / ducklake helpers) rather than inventing a parallel store.
+- \`bun\` / \`python3\` — only for work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node produces tabular data for downstream steps, write it **straight into DuckLake** (or a data table) from the same script — see "Ingesting from Python / TypeScript" below — rather than inventing a parallel store.
 
 Do not spread a pipeline across postgres, S3, and DuckLake when one DuckLake lake would do; a consistent DuckLake lakehouse is the goal.
 
+## Ingesting from Python / TypeScript
+
+A node that fetches data in code (an API, a SaaS export, a scraper) writes the rows **directly** into their DuckLake table with \`wmill.ducklake()\`, or into a data table with \`wmill.datatable()\`. DuckLake already stores every table as parquet files in the workspace object storage, so **never stage the raw payload first** — no intermediate JSON / CSV / parquet file in S3 and no second "load the raw file" node. One ingestion node, one table.
+
+Pass the rows as a query argument (a list of dicts / array of objects is sent as JSON) and let SQL unnest them; declare the column types so the table gets a real schema:
+
+\`\`\`python
+# pipeline
+# on schedule
+import wmill
+
+def main():
+    rows = fetch_charges()  # list[dict]
+    lake = wmill.ducklake()
+    lake.query("""
+        CREATE OR REPLACE TABLE stripe_charges AS
+        SELECT unnest(from_json($rows, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)
+    """, rows=rows).fetch()
+\`\`\`
+
+\`\`\`ts
+// pipeline
+// on schedule
+import * as wmill from "windmill-client"
+
+export async function main() {
+  const rows = await fetchCharges()
+  const lake = wmill.ducklake()
+  await lake\`CREATE OR REPLACE TABLE stripe_charges AS
+    SELECT unnest(from_json(\${rows}, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)\`.fetch()
+}
+\`\`\`
+
+- Use \`INSERT INTO <table> SELECT ...\` instead of \`CREATE OR REPLACE\` to append (an incremental pull), with a one-time \`CREATE TABLE IF NOT EXISTS\` first.
+- Assign the client to a variable (\`lake = wmill.ducklake()\`) and keep the SQL a **string literal** (Python) or a template without \`sql.raw\` (TS): that is what lets the graph record the node's write to \`ducklake://main/<table>\`. A chained \`wmill.ducklake().query(...)\` or SQL built in a variable records no output, so the downstream edge never forms.
+- \`wmill.ducklake("<name>")\` targets a non-default catalog; \`wmill.datatable("<name>")\` writes a Postgres data table the same way (Python \`db.query(sql, *args)\` with \`$1\` placeholders, TS the same template form) — use it only when the data belongs in Postgres (see above).
+- The downstream node triggers on the table itself: \`-- on ducklake://main/stripe_charges\`.
+
 ## Storage prerequisites
 
 A DuckLake pipeline only runs once the workspace has **object storage** (S3 / Azure Blob / GCS) **and a DuckLake catalog** configured — DuckLake tables and \`s3://\` assets can't be materialized or read without it. Check which DuckLake catalogs the workspace has before you build.
@@ -1232,7 +1274,7 @@ The key must be a **string literal** — the graph parser is static and cannot f
 
 ## Materialize (the managed output)
 
-> **A MANAGED \`// materialize\` is DuckDB-only**, and its target must be a DuckLake table (\`ducklake://<name>/<table>\`). Deploy **rejects** a \`ducklake://\` \`// materialize\` on any other language (\`python3\`, \`bun\`, \`postgresql\`). For a non-DuckDB node writing the lake, do **not** use \`// materialize\` — write the output via the SDK (\`wmill.writeS3File(...)\`, ducklake helpers, …) and let it be inferred. Use \`duckdb\` when a node should materialize a DuckLake table.
+> **A MANAGED \`// materialize\` is DuckDB-only**, and its target must be a DuckLake table (\`ducklake://<name>/<table>\`). Deploy **rejects** a \`ducklake://\` \`// materialize\` on any other language (\`python3\`, \`bun\`, \`postgresql\`). For a non-DuckDB node writing the lake, do **not** use \`// materialize\` — write the table itself with \`wmill.ducklake()\` (see "Ingesting from Python / TypeScript") and let the output be inferred. Use \`duckdb\` when a node should materialize a DuckLake table.
 >
 > The one target ANY language may declare (except a dbt script, whose writes come from its manifest) is a **warehouse relation**: \`// materialize manual dbt://<warehouse>/<schema>/<name>\`, where \`<warehouse>\` is a warehouse the workspace configures under Settings → dbt. \`manual\` is the only mode it has — nothing generates warehouse DDL, so the node issues its own write (a postgresql \`CREATE TABLE\` / \`INSERT\`, an SDK load, …) and the annotation records the outcome. Use it on an ingestion node whose output a dbt project reads as a \`source\`: the declared relation and the dbt model land on ONE graph node, and a downstream \`// on dbt://<warehouse>/<schema>/<name>\` fires when the ingestion node completes.
 
@@ -1648,21 +1690,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -1718,6 +1762,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -2210,10 +2262,14 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 def create_token(duration = dt.timedelta(days=1)) -> str
 
 # Create a script job by path and return its job id.
-def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# 
+# \`\`retry\`\` re-runs the job when it fails, with the policy a schedule takes,
+# e.g. \`\`{"constant": {"attempts": 3, "seconds": 10}}\`\`. The returned id is
+# the first attempt's; each retry is a job of its own, recorded as a child of it.
+def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
-# Create a script job by hash and return its job id.
-def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# Create a script job by hash and return its job id. See \`\`run_script_by_path_async\`\` for \`\`retry\`\`.
+def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
@@ -2386,6 +2442,18 @@ def set_progress(value: int, job_id: Optional[str] = None)
 #     Progress value (0-100) or None if not set
 def get_progress(job_id: Optional[str] = None) -> Any
 
+# Whether the worker running the job has received its shutdown signal.
+# 
+# A draining worker waits for its current job to finish before exiting. A long-running
+# script can poll this and return early so the worker can be replaced.
+# 
+# Args:
+#     job_id: Job ID (defaults to current WM_JOB_ID)
+# 
+# Returns:
+#     True if the worker running the job is draining
+def worker_is_draining(job_id: Optional[str] = None) -> bool
+
 # Set the user state of a flow at a given key
 def set_flow_user_state(key: str, value: Any) -> None
 
@@ -3475,7 +3543,7 @@ class SqlQuery:
 
 export const OPENFLOW_SCHEMA = `## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\\n\`memory_id\`). Without a memory id the agent runs without memory.\\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the \`memory_id\` here.\\nThe step's own \`memory_id\` is not read while this kind is set; switch the kind to \`window\`\\nto use it. Without a \`context_length\`, or with 0, it is \`off\` and reads \`previous_messages\`.\\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's \`memory_id\`), replacing\\nits older part with a summary as the conversation approaches the model's context window.\\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\\nWindmill does not know needs one; those fall back to 128000.\\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to \`off\` with \`previous_messages\` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see \`memory_id\`. While it is off, a step can supply its history in \`previous_messages\`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\\nflow.input syntax. Required unless memory is off and \`previous_messages\` supplies\\nthe prompt; image output always needs it.\\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\\nwas started with (the chat conversation, an app chat session or the \`memory_id\` run\\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\\nacross every run; an expression such as \`flow_input.customer_id\` keeps one memory per\\nkey. When it evaluates to an empty value the agent runs without memory. Read only\\nwhile \`memory\` is \`window\` or \`compaction\`: it is ignored when memory is off, and an\\nolder \`auto\` or \`manual\` memory reads neither history input.\\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\\nand the user message. Read only while \`memory\` is off or absent: managed memory\\nignores it, and an older \`auto\` or \`manual\` memory reads neither history input.\\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in \`tools\` the agent may call\\nthis run. Leaving it unset carries every one of them; an empty array carries none.\\nA tool is named as the model is shown it. An entry the model is shown nothing of is\\nnamed by what identifies it instead: an MCP server by its resource path, carrying\\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\\n(no tool may take that name).\\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\\nstate with calibrated probabilities, instead of generating text.\\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\\nthe answers, follow it with a branchone whose branch exprs read\\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\\nsupplies the state.\\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\\nAn object with descriptive keys holding only what the questions need works best.\\nExample: { message: flow_input.message, plan: results.a.plan }\\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\\n- 'choice': criteria maps each option to its description (up to 255); the answer\\n  has choice, probabilities and confidence\\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\\n  has score, legend, probabilities and confidence\\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\\n  noul, the probability of yes (0 to 1)\\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default \`flow\`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`;
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff: the n-th retry waits multiplier \\u00d7 seconds^n","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Base of the exponential (seconds); the n-th retry waits multiplier \\u00d7 seconds^n, where n counts constant retries too"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\\n\`memory_id\`). Without a memory id the agent runs without memory.\\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the \`memory_id\` here.\\nThe step's own \`memory_id\` is not read while this kind is set; switch the kind to \`window\`\\nto use it. Without a \`context_length\`, or with 0, it is \`off\` and reads \`previous_messages\`.\\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's \`memory_id\`), replacing\\nits older part with a summary as the conversation approaches the model's context window.\\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\\nWindmill does not know needs one; those fall back to 128000.\\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to \`off\` with \`previous_messages\` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see \`memory_id\`. While it is off, a step can supply its history in \`previous_messages\`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\\nflow.input syntax. Required unless memory is off and \`previous_messages\` supplies\\nthe prompt; image output always needs it.\\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\\nwas started with (the chat conversation, an app chat session or the \`memory_id\` run\\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\\nacross every run; an expression such as \`flow_input.customer_id\` keeps one memory per\\nkey. When it evaluates to an empty value the agent runs without memory. Read only\\nwhile \`memory\` is \`window\` or \`compaction\`: it is ignored when memory is off, and an\\nolder \`auto\` or \`manual\` memory reads neither history input.\\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\\nand the user message. Read only while \`memory\` is off or absent: managed memory\\nignores it, and an older \`auto\` or \`manual\` memory reads neither history input.\\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in \`tools\` the agent may call\\nthis run. Leaving it unset carries every one of them; an empty array carries none.\\nA tool is named as the model is shown it. An entry the model is shown nothing of is\\nnamed by what identifies it instead: an MCP server by its resource path, carrying\\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\\n(no tool may take that name).\\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\\nstate with calibrated probabilities, instead of generating text.\\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\\nthe answers, follow it with a branchone whose branch exprs read\\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\\nsupplies the state.\\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\\nAn object with descriptive keys holding only what the questions need works best.\\nExample: { message: flow_input.message, plan: results.a.plan }\\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\\n- 'choice': criteria maps each option to its description (up to 255); the answer\\n  has choice, probabilities and confidence\\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\\n  has score, legend, probabilities and confidence\\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\\n  noul, the probability of yes (0 to 1)\\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default \`flow\`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`;
 
 export const CLI_COMMANDS = `# Windmill CLI Commands
 
@@ -4206,6 +4274,8 @@ user related commands
 
 **Subcommands:**
 
+- \`user list\` - List the users of the workspace
+  - \`--json\` - Output as JSON (for piping to jq)
 - \`user add <email:string> [password:string]\` - Create a user
   - \`--superadmin\` - Specify to make the new user superadmin.
   - \`--company <company:string>\` - Specify to set the company of the new user.
diff --git a/system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml b/system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml
index 70a955d16d..5d5b0f8a0d 100644
--- a/system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml
@@ -84,7 +84,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -95,7 +96,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/azure_trigger.schema.yaml b/system_prompts/auto-generated/schemas/azure_trigger.schema.yaml
index d21d006e8d..e57c92ebc3 100644
--- a/system_prompts/auto-generated/schemas/azure_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/azure_trigger.schema.yaml
@@ -71,7 +71,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -82,7 +83,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/email_trigger.schema.yaml b/system_prompts/auto-generated/schemas/email_trigger.schema.yaml
index 1d4e81ac2c..79786fc8db 100644
--- a/system_prompts/auto-generated/schemas/email_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/email_trigger.schema.yaml
@@ -54,7 +54,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -65,7 +66,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/gcp_trigger.schema.yaml b/system_prompts/auto-generated/schemas/gcp_trigger.schema.yaml
index f35b33ad74..6755d6545c 100644
--- a/system_prompts/auto-generated/schemas/gcp_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/gcp_trigger.schema.yaml
@@ -94,7 +94,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -105,7 +106,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/http_trigger.schema.yaml b/system_prompts/auto-generated/schemas/http_trigger.schema.yaml
index f484366783..b428fbf390 100644
--- a/system_prompts/auto-generated/schemas/http_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/http_trigger.schema.yaml
@@ -133,7 +133,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -144,7 +145,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/kafka_trigger.schema.yaml b/system_prompts/auto-generated/schemas/kafka_trigger.schema.yaml
index 09217692e5..6549ce1b10 100644
--- a/system_prompts/auto-generated/schemas/kafka_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/kafka_trigger.schema.yaml
@@ -135,7 +135,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -146,7 +147,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/mqtt_trigger.schema.yaml b/system_prompts/auto-generated/schemas/mqtt_trigger.schema.yaml
index 2801cc9a73..f167e2965f 100644
--- a/system_prompts/auto-generated/schemas/mqtt_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/mqtt_trigger.schema.yaml
@@ -96,7 +96,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -107,7 +108,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/nats_trigger.schema.yaml b/system_prompts/auto-generated/schemas/nats_trigger.schema.yaml
index 239d568fcc..e7620683e6 100644
--- a/system_prompts/auto-generated/schemas/nats_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/nats_trigger.schema.yaml
@@ -70,7 +70,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -81,7 +82,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/postgres_trigger.schema.yaml b/system_prompts/auto-generated/schemas/postgres_trigger.schema.yaml
index be196a7bc3..79cca28595 100644
--- a/system_prompts/auto-generated/schemas/postgres_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/postgres_trigger.schema.yaml
@@ -63,7 +63,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -74,7 +75,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/schedule.schema.yaml b/system_prompts/auto-generated/schemas/schedule.schema.yaml
index d0ea85d6fe..7097be7d25 100644
--- a/system_prompts/auto-generated/schemas/schedule.schema.yaml
+++ b/system_prompts/auto-generated/schemas/schedule.schema.yaml
@@ -69,7 +69,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -80,7 +81,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/sqs_trigger.schema.yaml b/system_prompts/auto-generated/schemas/sqs_trigger.schema.yaml
index 4f41c32421..32d6400973 100644
--- a/system_prompts/auto-generated/schemas/sqs_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/sqs_trigger.schema.yaml
@@ -69,7 +69,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -80,7 +81,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/websocket_trigger.schema.yaml b/system_prompts/auto-generated/schemas/websocket_trigger.schema.yaml
index 780b0f2245..8184d3815a 100644
--- a/system_prompts/auto-generated/schemas/websocket_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/websocket_trigger.schema.yaml
@@ -172,7 +172,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -183,7 +184,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/script.md b/system_prompts/auto-generated/script.md
index 0517cf1897..14ca869180 100644
--- a/system_prompts/auto-generated/script.md
+++ b/system_prompts/auto-generated/script.md
@@ -1567,21 +1567,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -1637,6 +1639,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -2129,10 +2139,14 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 def create_token(duration = dt.timedelta(days=1)) -> str
 
 # Create a script job by path and return its job id.
-def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# 
+# ``retry`` re-runs the job when it fails, with the policy a schedule takes,
+# e.g. ``{"constant": {"attempts": 3, "seconds": 10}}``. The returned id is
+# the first attempt's; each retry is a job of its own, recorded as a child of it.
+def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
-# Create a script job by hash and return its job id.
-def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# Create a script job by hash and return its job id. See ``run_script_by_path_async`` for ``retry``.
+def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
@@ -2305,6 +2319,18 @@ def set_progress(value: int, job_id: Optional[str] = None)
 #     Progress value (0-100) or None if not set
 def get_progress(job_id: Optional[str] = None) -> Any
 
+# Whether the worker running the job has received its shutdown signal.
+# 
+# A draining worker waits for its current job to finish before exiting. A long-running
+# script can poll this and return early so the worker can be replaced.
+# 
+# Args:
+#     job_id: Job ID (defaults to current WM_JOB_ID)
+# 
+# Returns:
+#     True if the worker running the job is draining
+def worker_is_draining(job_id: Optional[str] = None) -> bool
+
 # Set the user state of a flow at a given key
 def set_flow_user_state(key: str, value: Any) -> None
 
diff --git a/system_prompts/auto-generated/sdks/python.md b/system_prompts/auto-generated/sdks/python.md
index 97db78b3d4..13a93ed063 100644
--- a/system_prompts/auto-generated/sdks/python.md
+++ b/system_prompts/auto-generated/sdks/python.md
@@ -60,10 +60,14 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 def create_token(duration = dt.timedelta(days=1)) -> str
 
 # Create a script job by path and return its job id.
-def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# 
+# ``retry`` re-runs the job when it fails, with the policy a schedule takes,
+# e.g. ``{"constant": {"attempts": 3, "seconds": 10}}``. The returned id is
+# the first attempt's; each retry is a job of its own, recorded as a child of it.
+def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
-# Create a script job by hash and return its job id.
-def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# Create a script job by hash and return its job id. See ``run_script_by_path_async`` for ``retry``.
+def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
@@ -236,6 +240,18 @@ def set_progress(value: int, job_id: Optional[str] = None)
 #     Progress value (0-100) or None if not set
 def get_progress(job_id: Optional[str] = None) -> Any
 
+# Whether the worker running the job has received its shutdown signal.
+# 
+# A draining worker waits for its current job to finish before exiting. A long-running
+# script can poll this and return early so the worker can be replaced.
+# 
+# Args:
+#     job_id: Job ID (defaults to current WM_JOB_ID)
+# 
+# Returns:
+#     True if the worker running the job is draining
+def worker_is_draining(job_id: Optional[str] = None) -> bool
+
 # Set the user state of a flow at a given key
 def set_flow_user_state(key: str, value: Any) -> None
 
diff --git a/system_prompts/auto-generated/sdks/typescript.md b/system_prompts/auto-generated/sdks/typescript.md
index 55f59b1f36..55df35ccf7 100644
--- a/system_prompts/auto-generated/sdks/typescript.md
+++ b/system_prompts/auto-generated/sdks/typescript.md
@@ -124,21 +124,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -194,6 +196,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
diff --git a/system_prompts/auto-generated/skills/cli-commands/SKILL.md b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
index 48ea832a31..3f41b5cfba 100644
--- a/system_prompts/auto-generated/skills/cli-commands/SKILL.md
+++ b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
@@ -732,6 +732,8 @@ user related commands
 
 **Subcommands:**
 
+- `user list` - List the users of the workspace
+  - `--json` - Output as JSON (for piping to jq)
 - `user add <email:string> [password:string]` - Create a user
   - `--superadmin` - Specify to make the new user superadmin.
   - `--company <company:string>` - Specify to set the company of the new user.
diff --git a/system_prompts/auto-generated/skills/write-flow/SKILL.md b/system_prompts/auto-generated/skills/write-flow/SKILL.md
index 352fe2ed48..4b0889c3d8 100644
--- a/system_prompts/auto-generated/skills/write-flow/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-flow/SKILL.md
@@ -371,6 +371,10 @@ can call one, not an agent used as a tool.
 - `results.step_id.property` - Access specific property from a previous step output only when that step result is in scope
 - `flow_input.iter.value` - Current iteration value inside a `forloopflow`; in a `whileloopflow` it is just the iteration index (a plain number, same as `flow_input.iter.index`)
 - `flow_input.iter.index` - Current loop index when inside a loop (`forloopflow` or `whileloopflow`)
+- After a suspend step (approval), the next step's javascript expressions also get:
+  - `resume` - the last resume payload (the resume form values); with `continue_on_disapprove_timeout`, a disapproval or timeout yields `{ error: { name: "SuspendedDisapproved" | "SuspendedTimedOut", message } }` instead
+  - `resumes` - every resume payload, in arrival order
+  - `approvers` - a plain array of strings, one per resume: for a resume through the `resume`/`cancel` URL from `getResumeUrls(approver)`, the `approver` passed there if any; otherwise (including the `approvalPage` link) the resuming user's username, else `"anonymous"`, e.g. `approvers[0]`. It is NOT the `{ resume_id, approver }` objects stored in the flow status, so `approvers[0].approver` is always undefined
 
 ## Loop Structure Rules
 
@@ -682,4 +686,4 @@ Reference a specific resource using `$res:` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
diff --git a/system_prompts/auto-generated/skills/write-pipeline/SKILL.md b/system_prompts/auto-generated/skills/write-pipeline/SKILL.md
index 064dc600ac..4c339e6222 100644
--- a/system_prompts/auto-generated/skills/write-pipeline/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-pipeline/SKILL.md
@@ -12,10 +12,48 @@ A **data pipeline** is NOT a flow. A flow is one runnable that orchestrates step
 A pipeline node that produces a table should almost always be a **`duckdb`** node that materializes its output into a **DuckLake** table with `-- materialize ducklake://<name>/<table>` (in a DuckDB node the annotation uses SQL `--` comment syntax; write the body as a bare `SELECT` and let the runtime do the write). DuckLake is the default lakehouse store for pipelines and is the shape the pipeline editor is built around, so prefer it unless the work specifically calls for something else:
 
 - `postgresql` / data tables — only for row-level, OLTP-style mutations against an existing Postgres data table (frequent single-row upserts/updates, transactional reads that an app queries live).
-- `bun` / `python3` — only for non-tabular work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node still produces tabular data for downstream steps, land it in DuckLake (write it with the wmill SDK / ducklake helpers) rather than inventing a parallel store.
+- `bun` / `python3` — only for work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node produces tabular data for downstream steps, write it **straight into DuckLake** (or a data table) from the same script — see "Ingesting from Python / TypeScript" below — rather than inventing a parallel store.
 
 Do not spread a pipeline across postgres, S3, and DuckLake when one DuckLake lake would do; a consistent DuckLake lakehouse is the goal.
 
+## Ingesting from Python / TypeScript
+
+A node that fetches data in code (an API, a SaaS export, a scraper) writes the rows **directly** into their DuckLake table with `wmill.ducklake()`, or into a data table with `wmill.datatable()`. DuckLake already stores every table as parquet files in the workspace object storage, so **never stage the raw payload first** — no intermediate JSON / CSV / parquet file in S3 and no second "load the raw file" node. One ingestion node, one table.
+
+Pass the rows as a query argument (a list of dicts / array of objects is sent as JSON) and let SQL unnest them; declare the column types so the table gets a real schema:
+
+```python
+# pipeline
+# on schedule
+import wmill
+
+def main():
+    rows = fetch_charges()  # list[dict]
+    lake = wmill.ducklake()
+    lake.query("""
+        CREATE OR REPLACE TABLE stripe_charges AS
+        SELECT unnest(from_json($rows, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)
+    """, rows=rows).fetch()
+```
+
+```ts
+// pipeline
+// on schedule
+import * as wmill from "windmill-client"
+
+export async function main() {
+  const rows = await fetchCharges()
+  const lake = wmill.ducklake()
+  await lake`CREATE OR REPLACE TABLE stripe_charges AS
+    SELECT unnest(from_json(${rows}, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)`.fetch()
+}
+```
+
+- Use `INSERT INTO <table> SELECT ...` instead of `CREATE OR REPLACE` to append (an incremental pull), with a one-time `CREATE TABLE IF NOT EXISTS` first.
+- Assign the client to a variable (`lake = wmill.ducklake()`) and keep the SQL a **string literal** (Python) or a template without `sql.raw` (TS): that is what lets the graph record the node's write to `ducklake://main/<table>`. A chained `wmill.ducklake().query(...)` or SQL built in a variable records no output, so the downstream edge never forms.
+- `wmill.ducklake("<name>")` targets a non-default catalog; `wmill.datatable("<name>")` writes a Postgres data table the same way (Python `db.query(sql, *args)` with `$1` placeholders, TS the same template form) — use it only when the data belongs in Postgres (see above).
+- The downstream node triggers on the table itself: `-- on ducklake://main/stripe_charges`.
+
 ## Storage prerequisites
 
 A DuckLake pipeline only runs once the workspace has **object storage** (S3 / Azure Blob / GCS) **and a DuckLake catalog** configured — DuckLake tables and `s3://` assets can't be materialized or read without it. Check which DuckLake catalogs the workspace has before you build.
@@ -59,7 +97,7 @@ The key must be a **string literal** — the graph parser is static and cannot f
 
 ## Materialize (the managed output)
 
-> **A MANAGED `// materialize` is DuckDB-only**, and its target must be a DuckLake table (`ducklake://<name>/<table>`). Deploy **rejects** a `ducklake://` `// materialize` on any other language (`python3`, `bun`, `postgresql`). For a non-DuckDB node writing the lake, do **not** use `// materialize` — write the output via the SDK (`wmill.writeS3File(...)`, ducklake helpers, …) and let it be inferred. Use `duckdb` when a node should materialize a DuckLake table.
+> **A MANAGED `// materialize` is DuckDB-only**, and its target must be a DuckLake table (`ducklake://<name>/<table>`). Deploy **rejects** a `ducklake://` `// materialize` on any other language (`python3`, `bun`, `postgresql`). For a non-DuckDB node writing the lake, do **not** use `// materialize` — write the table itself with `wmill.ducklake()` (see "Ingesting from Python / TypeScript") and let the output be inferred. Use `duckdb` when a node should materialize a DuckLake table.
 >
 > The one target ANY language may declare (except a dbt script, whose writes come from its manifest) is a **warehouse relation**: `// materialize manual dbt://<warehouse>/<schema>/<name>`, where `<warehouse>` is a warehouse the workspace configures under Settings → dbt. `manual` is the only mode it has — nothing generates warehouse DDL, so the node issues its own write (a postgresql `CREATE TABLE` / `INSERT`, an SDK load, …) and the annotation records the outcome. Use it on an ingestion node whose output a dbt project reads as a `source`: the declared relation and the dbt model land on ONE graph node, and a downstream `// on dbt://<warehouse>/<schema>/<name>` fires when the ingestion node completes.
 
diff --git a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
index 4b340c0db1..6ad44db068 100644
--- a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
@@ -320,21 +320,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -390,6 +392,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
diff --git a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
index 03d40ab044..a5f599a946 100644
--- a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
@@ -332,21 +332,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -402,6 +404,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
diff --git a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
index b15655a6da..ce0c610da7 100644
--- a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
@@ -322,21 +322,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -392,6 +394,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
diff --git a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
index b9c2793f47..4946ed0f6e 100644
--- a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
@@ -268,10 +268,14 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 def create_token(duration = dt.timedelta(days=1)) -> str
 
 # Create a script job by path and return its job id.
-def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# 
+# ``retry`` re-runs the job when it fails, with the policy a schedule takes,
+# e.g. ``{"constant": {"attempts": 3, "seconds": 10}}``. The returned id is
+# the first attempt's; each retry is a job of its own, recorded as a child of it.
+def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
-# Create a script job by hash and return its job id.
-def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# Create a script job by hash and return its job id. See ``run_script_by_path_async`` for ``retry``.
+def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
@@ -444,6 +448,18 @@ def set_progress(value: int, job_id: Optional[str] = None)
 #     Progress value (0-100) or None if not set
 def get_progress(job_id: Optional[str] = None) -> Any
 
+# Whether the worker running the job has received its shutdown signal.
+# 
+# A draining worker waits for its current job to finish before exiting. A long-running
+# script can poll this and return early so the worker can be replaced.
+# 
+# Args:
+#     job_id: Job ID (defaults to current WM_JOB_ID)
+# 
+# Returns:
+#     True if the worker running the job is draining
+def worker_is_draining(job_id: Optional[str] = None) -> bool
+
 # Set the user state of a flow at a given key
 def set_flow_user_state(key: str, value: Any) -> None
 
diff --git a/system_prompts/base/flow-base.md b/system_prompts/base/flow-base.md
index ddb10fd0fa..ff10f38062 100644
--- a/system_prompts/base/flow-base.md
+++ b/system_prompts/base/flow-base.md
@@ -289,6 +289,10 @@ can call one, not an agent used as a tool.
 - `results.step_id.property` - Access specific property from a previous step output only when that step result is in scope
 - `flow_input.iter.value` - Current iteration value inside a `forloopflow`; in a `whileloopflow` it is just the iteration index (a plain number, same as `flow_input.iter.index`)
 - `flow_input.iter.index` - Current loop index when inside a loop (`forloopflow` or `whileloopflow`)
+- After a suspend step (approval), the next step's javascript expressions also get:
+  - `resume` - the last resume payload (the resume form values); with `continue_on_disapprove_timeout`, a disapproval or timeout yields `{ error: { name: "SuspendedDisapproved" | "SuspendedTimedOut", message } }` instead
+  - `resumes` - every resume payload, in arrival order
+  - `approvers` - a plain array of strings, one per resume: for a resume through the `resume`/`cancel` URL from `getResumeUrls(approver)`, the `approver` passed there if any; otherwise (including the `approvalPage` link) the resuming user's username, else `"anonymous"`, e.g. `approvers[0]`. It is NOT the `{ resume_id, approver }` objects stored in the flow status, so `approvers[0].approver` is always undefined
 
 ## Loop Structure Rules
 
diff --git a/system_prompts/base/pipeline-base.md b/system_prompts/base/pipeline-base.md
index 01e9797e32..59924faf41 100644
--- a/system_prompts/base/pipeline-base.md
+++ b/system_prompts/base/pipeline-base.md
@@ -7,10 +7,48 @@ A **data pipeline** is NOT a flow. A flow is one runnable that orchestrates step
 A pipeline node that produces a table should almost always be a **`duckdb`** node that materializes its output into a **DuckLake** table with `-- materialize ducklake://<name>/<table>` (in a DuckDB node the annotation uses SQL `--` comment syntax; write the body as a bare `SELECT` and let the runtime do the write). DuckLake is the default lakehouse store for pipelines and is the shape the pipeline editor is built around, so prefer it unless the work specifically calls for something else:
 
 - `postgresql` / data tables — only for row-level, OLTP-style mutations against an existing Postgres data table (frequent single-row upserts/updates, transactional reads that an app queries live).
-- `bun` / `python3` — only for non-tabular work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node still produces tabular data for downstream steps, land it in DuckLake (write it with the wmill SDK / ducklake helpers) rather than inventing a parallel store.
+- `bun` / `python3` — only for work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node produces tabular data for downstream steps, write it **straight into DuckLake** (or a data table) from the same script — see "Ingesting from Python / TypeScript" below — rather than inventing a parallel store.
 
 Do not spread a pipeline across postgres, S3, and DuckLake when one DuckLake lake would do; a consistent DuckLake lakehouse is the goal.
 
+## Ingesting from Python / TypeScript
+
+A node that fetches data in code (an API, a SaaS export, a scraper) writes the rows **directly** into their DuckLake table with `wmill.ducklake()`, or into a data table with `wmill.datatable()`. DuckLake already stores every table as parquet files in the workspace object storage, so **never stage the raw payload first** — no intermediate JSON / CSV / parquet file in S3 and no second "load the raw file" node. One ingestion node, one table.
+
+Pass the rows as a query argument (a list of dicts / array of objects is sent as JSON) and let SQL unnest them; declare the column types so the table gets a real schema:
+
+```python
+# pipeline
+# on schedule
+import wmill
+
+def main():
+    rows = fetch_charges()  # list[dict]
+    lake = wmill.ducklake()
+    lake.query("""
+        CREATE OR REPLACE TABLE stripe_charges AS
+        SELECT unnest(from_json($rows, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)
+    """, rows=rows).fetch()
+```
+
+```ts
+// pipeline
+// on schedule
+import * as wmill from "windmill-client"
+
+export async function main() {
+  const rows = await fetchCharges()
+  const lake = wmill.ducklake()
+  await lake`CREATE OR REPLACE TABLE stripe_charges AS
+    SELECT unnest(from_json(${rows}, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)`.fetch()
+}
+```
+
+- Use `INSERT INTO <table> SELECT ...` instead of `CREATE OR REPLACE` to append (an incremental pull), with a one-time `CREATE TABLE IF NOT EXISTS` first.
+- Assign the client to a variable (`lake = wmill.ducklake()`) and keep the SQL a **string literal** (Python) or a template without `sql.raw` (TS): that is what lets the graph record the node's write to `ducklake://main/<table>`. A chained `wmill.ducklake().query(...)` or SQL built in a variable records no output, so the downstream edge never forms.
+- `wmill.ducklake("<name>")` targets a non-default catalog; `wmill.datatable("<name>")` writes a Postgres data table the same way (Python `db.query(sql, *args)` with `$1` placeholders, TS the same template form) — use it only when the data belongs in Postgres (see above).
+- The downstream node triggers on the table itself: `-- on ducklake://main/stripe_charges`.
+
 ## Storage prerequisites
 
 A DuckLake pipeline only runs once the workspace has **object storage** (S3 / Azure Blob / GCS) **and a DuckLake catalog** configured — DuckLake tables and `s3://` assets can't be materialized or read without it. Check which DuckLake catalogs the workspace has before you build.
@@ -56,7 +94,7 @@ The key must be a **string literal** — the graph parser is static and cannot f
 
 ## Materialize (the managed output)
 
-> **A MANAGED `// materialize` is DuckDB-only**, and its target must be a DuckLake table (`ducklake://<name>/<table>`). Deploy **rejects** a `ducklake://` `// materialize` on any other language (`python3`, `bun`, `postgresql`). For a non-DuckDB node writing the lake, do **not** use `// materialize` — write the output via the SDK (`wmill.writeS3File(...)`, ducklake helpers, …) and let it be inferred. Use `duckdb` when a node should materialize a DuckLake table.
+> **A MANAGED `// materialize` is DuckDB-only**, and its target must be a DuckLake table (`ducklake://<name>/<table>`). Deploy **rejects** a `ducklake://` `// materialize` on any other language (`python3`, `bun`, `postgresql`). For a non-DuckDB node writing the lake, do **not** use `// materialize` — write the table itself with `wmill.ducklake()` (see "Ingesting from Python / TypeScript") and let the output be inferred. Use `duckdb` when a node should materialize a DuckLake table.
 >
 > The one target ANY language may declare (except a dbt script, whose writes come from its manifest) is a **warehouse relation**: `// materialize manual dbt://<warehouse>/<schema>/<name>`, where `<warehouse>` is a warehouse the workspace configures under Settings → dbt. `manual` is the only mode it has — nothing generates warehouse DDL, so the node issues its own write (a postgresql `CREATE TABLE` / `INSERT`, an SDK load, …) and the annotation records the outcome. Use it on an ingestion node whose output a dbt project reads as a `source`: the declared relation and the dbt model land on ONE graph node, and a downstream `// on dbt://<warehouse>/<schema>/<name>` fires when the ingestion node completes.
 
diff --git a/typescript-client/build.jsr.sh b/typescript-client/build.jsr.sh
index e1ad956dc4..41a8eac37e 100755
--- a/typescript-client/build.jsr.sh
+++ b/typescript-client/build.jsr.sh
@@ -22,6 +22,6 @@ cp "${script_dirpath}/sqlUtils.ts" "${script_dirpath}/src/"
 echo "" >> "${script_dirpath}/src/index.ts"
 echo 'export type { DenoS3LightClientSettings } from "./s3Types";' >> "${script_dirpath}/src/index.ts"
 echo "" >> "${script_dirpath}/src/index.ts"
-echo 'export { type Base64, setClient, getWorkspace, workerHasInternalServer, SHARED_FOLDER, getStatePath, getInternalState, setInternalState, getResumeEndpoints, getResult, getResultMaybe, resolveDefaultResource, databaseUrlFromResource, base64ToUint8Array, uint8ArrayToBase64, getVariable, setVariable, getResource, setResource, getResumeUrls, setState, setProgress, getProgress, getState, getIdToken, denoS3LightClientSettings, cancelJob, loadS3FileStream, loadS3File, writeS3File, deleteS3File, signS3Objects, signS3Object, getPresignedS3PublicUrls, getPresignedS3PublicUrl, task, runScript, runScriptAsync, runScriptByPath, runScriptByHash, runScriptByPathAsync, runScriptByHashAsync, runFlow, runFlowAsync, waitJob, getRootJobId, setFlowUserState, getFlowUserState, usernameToEmail, requestInteractiveSlackApproval, type Sql, requestInteractiveTeamsApproval, appendToResultStream, streamResult, datatable, ducklake, upsertPartition, appendPartition, type DucklakeMaterializeOptions, type SqlStatement, type DatatableSqlTemplateFunction, type SqlTemplateFunction, type S3Object, type S3ObjectRecord, type S3ObjectURI } from "./client";' >> "${script_dirpath}/src/index.ts"
+echo 'export { type Base64, setClient, getWorkspace, workerHasInternalServer, SHARED_FOLDER, getStatePath, getInternalState, setInternalState, getResumeEndpoints, getResult, getResultMaybe, resolveDefaultResource, databaseUrlFromResource, base64ToUint8Array, uint8ArrayToBase64, getVariable, setVariable, getResource, setResource, getResumeUrls, setState, setProgress, getProgress, workerIsDraining, getState, getIdToken, denoS3LightClientSettings, cancelJob, loadS3FileStream, loadS3File, writeS3File, deleteS3File, signS3Objects, signS3Object, getPresignedS3PublicUrls, getPresignedS3PublicUrl, task, runScript, runScriptAsync, runScriptByPath, runScriptByHash, runScriptByPathAsync, runScriptByHashAsync, type RunScriptAsyncOptions, runFlow, runFlowAsync, waitJob, getRootJobId, setFlowUserState, getFlowUserState, usernameToEmail, requestInteractiveSlackApproval, type Sql, requestInteractiveTeamsApproval, appendToResultStream, streamResult, datatable, ducklake, upsertPartition, appendPartition, type DucklakeMaterializeOptions, type SqlStatement, type DatatableSqlTemplateFunction, type SqlTemplateFunction, type S3Object, type S3ObjectRecord, type S3ObjectURI } from "./client";' >> "${script_dirpath}/src/index.ts"
 
 
diff --git a/typescript-client/build.sh b/typescript-client/build.sh
index 8b51f75dfc..f927acd26e 100755
--- a/typescript-client/build.sh
+++ b/typescript-client/build.sh
@@ -46,7 +46,7 @@ cp "${script_dirpath}/sqlUtils.ts" "${script_dirpath}/src/"
 echo "" >> "${script_dirpath}/src/index.ts"
 echo 'export type { DenoS3LightClientSettings } from "./s3Types";' >> "${script_dirpath}/src/index.ts"
 echo "" >> "${script_dirpath}/src/index.ts"
-echo 'export { type Base64, setClient, getWorkspace, workerHasInternalServer, SHARED_FOLDER, getStatePath, getInternalState, setInternalState, getResumeEndpoints, getResult, getResultMaybe, resolveDefaultResource, databaseUrlFromResource, base64ToUint8Array, uint8ArrayToBase64, getVariable, setVariable, getResource, setResource, getResumeUrls, setState, setProgress, getProgress, getState, getIdToken, denoS3LightClientSettings, cancelJob, loadS3FileStream, loadS3File, writeS3File, deleteS3File, signS3Objects, signS3Object, getPresignedS3PublicUrls, getPresignedS3PublicUrl, task, taskScript, taskFlow, workflow, step, sleep, parallel, waitForApproval, getApprovalUrls, type TaskOptions, type TaskRetry, type Jsonified, type JsonifiedFn, WorkflowCtx, _workflowCtx, setWorkflowCtx, StepSuspend, runScript, runScriptAsync, runScriptByPath, runScriptByHash, runScriptByPathAsync, runScriptByHashAsync, runFlow, runFlowAsync, waitJob, getRootJobId, setFlowUserState, getFlowUserState, usernameToEmail, requestInteractiveSlackApproval, type Sql, requestInteractiveTeamsApproval, appendToResultStream, streamResult, datatable, ducklake, upsertPartition, appendPartition, type DucklakeMaterializeOptions, type SqlStatement, type DatatableSqlTemplateFunction, type SqlTemplateFunction, type S3Object, type S3ObjectRecord, type S3ObjectURI, commitKafkaOffsets } from "./client";' >> "${script_dirpath}/src/index.ts"
+echo 'export { type Base64, setClient, getWorkspace, workerHasInternalServer, SHARED_FOLDER, getStatePath, getInternalState, setInternalState, getResumeEndpoints, getResult, getResultMaybe, resolveDefaultResource, databaseUrlFromResource, base64ToUint8Array, uint8ArrayToBase64, getVariable, setVariable, getResource, setResource, getResumeUrls, setState, setProgress, getProgress, workerIsDraining, getState, getIdToken, denoS3LightClientSettings, cancelJob, loadS3FileStream, loadS3File, writeS3File, deleteS3File, signS3Objects, signS3Object, getPresignedS3PublicUrls, getPresignedS3PublicUrl, task, taskScript, taskFlow, workflow, step, sleep, parallel, waitForApproval, getApprovalUrls, type TaskOptions, type TaskRetry, type Jsonified, type JsonifiedFn, WorkflowCtx, _workflowCtx, setWorkflowCtx, StepSuspend, runScript, runScriptAsync, runScriptByPath, runScriptByHash, runScriptByPathAsync, runScriptByHashAsync, type RunScriptAsyncOptions, runFlow, runFlowAsync, waitJob, getRootJobId, setFlowUserState, getFlowUserState, usernameToEmail, requestInteractiveSlackApproval, type Sql, requestInteractiveTeamsApproval, appendToResultStream, streamResult, datatable, ducklake, upsertPartition, appendPartition, type DucklakeMaterializeOptions, type SqlStatement, type DatatableSqlTemplateFunction, type SqlTemplateFunction, type S3Object, type S3ObjectRecord, type S3ObjectURI, commitKafkaOffsets } from "./client";' >> "${script_dirpath}/src/index.ts"
 
 # Build default export by combining client utilities + services
 # This preserves backward compatibility for `import wmill from "windmill-client"`
@@ -63,6 +63,7 @@ import {
   setState,
   setProgress,
   getProgress,
+  workerIsDraining,
   getState,
   getIdToken,
   denoS3LightClientSettings,
@@ -153,6 +154,7 @@ const wmill = {
   setState,
   setProgress,
   getProgress,
+  workerIsDraining,
   getState,
   getIdToken,
   denoS3LightClientSettings,
diff --git a/typescript-client/client.ts b/typescript-client/client.ts
index 7e84320346..3f7b03117a 100644
--- a/typescript-client/client.ts
+++ b/typescript-client/client.ts
@@ -11,6 +11,7 @@ import {
   UserService,
   KafkaTriggerService,
 } from "./services.gen";
+import type { Retry } from "./types.gen";
 import { OpenAPI } from "./core/OpenAPI";
 import { isSuspendSignal, stepErrorMarker, taskErrorFromMarker } from "./wacError";
 // import type { DenoS3LightClientSettings } from "./index";
@@ -420,12 +421,26 @@ export async function runScriptAsync(
   return _runScriptAsyncInternal(path, hash_, args, scheduledInSeconds, tag);
 }
 
+/** Options for {@link runScriptByPathAsync} and {@link runScriptByHashAsync}, passed in
+ *  place of `scheduledInSeconds`; a positional `tag` is then ignored. */
+export interface RunScriptAsyncOptions {
+  /** Schedule execution for a future time (in seconds) */
+  scheduledInSeconds?: number;
+  /** Override the worker tag the job runs on */
+  tag?: string;
+  /** Re-run the job when it fails, with the same policy a schedule takes, e.g.
+   *  `{ constant: { attempts: 3, seconds: 10 } }`. The returned id is the first
+   *  attempt's; each retry is a job of its own, recorded as a child of it. */
+  retry?: Retry;
+}
+
 async function _runScriptAsyncInternal(
   path: string | null = null,
   hash_: string | null = null,
   args: Record<string, any> | null = null,
   scheduledInSeconds: number | null = null,
-  tag: string | null = null
+  tag: string | null = null,
+  retry: Retry | null = null
 ): Promise<string> {
   // Create a script job and return its job id.
   args = args || {};
@@ -439,6 +454,10 @@ async function _runScriptAsyncInternal(
     params["tag"] = tag;
   }
 
+  if (retry) {
+    params["retry"] = JSON.stringify(retry);
+  }
+
   let parentJobId = getEnv("WM_JOB_ID");
   if (parentJobId !== undefined) {
     params["parent_job"] = parentJobId;
@@ -475,34 +494,47 @@ async function _runScriptAsyncInternal(
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
 export async function runScriptByPathAsync(
   path: string,
   args: Record<string, any> | null = null,
-  scheduledInSeconds: number | null = null,
+  scheduledInSeconds: number | null | RunScriptAsyncOptions = null,
   tag: string | null = null
 ): Promise<string> {
-  return _runScriptAsyncInternal(path, null, args, scheduledInSeconds, tag);
+  const o = asyncRunOptions(scheduledInSeconds, tag);
+  return _runScriptAsyncInternal(path, null, args, o.scheduledInSeconds, o.tag, o.retry);
 }
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
 export async function runScriptByHashAsync(
   hash_: string,
   args: Record<string, any> | null = null,
-  scheduledInSeconds: number | null = null,
+  scheduledInSeconds: number | null | RunScriptAsyncOptions = null,
   tag: string | null = null
 ): Promise<string> {
-  return _runScriptAsyncInternal(null, hash_, args, scheduledInSeconds, tag);
+  const o = asyncRunOptions(scheduledInSeconds, tag);
+  return _runScriptAsyncInternal(null, hash_, args, o.scheduledInSeconds, o.tag, o.retry);
+}
+
+function asyncRunOptions(
+  scheduledInSeconds: number | null | RunScriptAsyncOptions,
+  tag: string | null
+): RunScriptAsyncOptions {
+  return typeof scheduledInSeconds === "object" && scheduledInSeconds !== null
+    ? scheduledInSeconds
+    : { scheduledInSeconds: scheduledInSeconds ?? undefined, tag: tag ?? undefined };
 }
 
 /**
@@ -692,6 +724,19 @@ export async function getProgress(jobId?: any): Promise<number | null> {
   });
 }
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+export async function workerIsDraining(jobId?: string): Promise<boolean> {
+  return await JobService.workerIsDraining({
+    id: jobId ?? getEnv("WM_JOB_ID") ?? "NO_JOB_ID",
+    workspace: getWorkspace(),
+  });
+}
+
 /**
  * Set a flow user state
  * @param key key of the state
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 615e7885eb..45306830f5 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.827.0",
+  "version": "1.828.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 59f4b98719..98caf3895a 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.827.0",
+  "version": "1.828.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 35d501b3a8..b08184bb19 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.827.0
+1.828.0
diff --git a/windmill-yaml-validator/package-lock.json b/windmill-yaml-validator/package-lock.json
index 295ba3e97a..064996f393 100644
--- a/windmill-yaml-validator/package-lock.json
+++ b/windmill-yaml-validator/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.827.0",
+  "version": "1.828.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-yaml-validator",
-      "version": "1.827.0",
+      "version": "1.828.0",
       "license": "Apache 2.0",
       "dependencies": {
         "@stoplight/yaml": "^4.3.0",
diff --git a/windmill-yaml-validator/package.json b/windmill-yaml-validator/package.json
index 05ba30630f..7e8c7a641d 100644
--- a/windmill-yaml-validator/package.json
+++ b/windmill-yaml-validator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.827.0",
+  "version": "1.828.0",
   "description": "YAML validator for Windmill flow, schedule, and trigger files",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",